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i __ We can go on the record. 


This is an interview of Stephanie Dobitsch conducted by the House Select 
Committee to Investigate the January 6th Attack on the United States Capitol pursuant to 
House Resolution 503. 

Ms. Dobitsch, could you please state your full name and spell your last name for 
the record? 

Ms. Dobitsch. Good morning, everyone. My name is Stephanie Dobitsch, 
D-o-b-i-t-s-c-h. 


And I'm going to introduce everyone in the room today for the 


record. We'llstart with my colleagues. I'll have the folks in the room introduce 
themselves. 

SE ::: coo 
morning. 


HE Good morning, this is MY, an investigative counsel with 


the select committee. 


BES do anticipate Senior Investigative Counse| 


will be joining us at some point, for the record. And | also see present with us virtually 
from the select committee is EM investigator. 

Could we have on your end, Ms. Dobitsch, any counsel present virtually? 

Ms. Rapoport. Hi, this is Victoria Rapaport from DHS, as you see, and we also 
have Hilary Ledwell, who's joining us virtually. 

W,s«(Did | get three names? So | see two of you on the screen. 

Ms. Rapoport. This is Victoria Rapoport from counsel's office, and we have some 


colleagues from our Office of Legislative Affairs. And two of the briefers from the 
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afternoon are joining us here as well. 

BE, Sometimes the court reporters ask that if -- | think if they're on 
camera or if there's even a possibility they might speak, that they'd like the names to be 
onthe record. Is that possible? 

Ms. Rapoport. Sure. Do you guys want to introduce yourselves? 

Mr. Dunlap. Yeah. Hi, it's James Dunlap. | am the director for 
counterterrorism here at I&A. 

Ms. Peterson. Goodafternoon. My name is Michelle Peterson, and lam an 
executive officer in the DUIEO office. 

Ms. Rapoport. And OLA, please. 

Mr. Lamote. Jason Lamote, L-a-m-o-t-e, with the Office of Legislative Affairs. 

Ms. Lynum. And Kara Lynum -- K-a-r-a, last name Lynum, L-y-n-u-m -- with the 
DHS Office of Legislative Affairs. 

Ms. Rapoport. And for my spelling, it's Victoria, and last name is Rapoport, 
R-a-p-o-p-o-r-t. 

[2 hl Thank you so much. 

And you've already mentioned Hilary Ledwell. You know, if she wants to speak, 
if she would just put on her camera. But, obviously, she doesn't need to if she's not 
speaking. 

This will be a staff-led interview, and members, of course, may choose to also ask 
questions if any join the call. 

My name 5 UlUUtCOCOY and I'm an investigative counsel for the select 
committee. 

Before we begin, I'd like to describe a few ground rules. There is an official 


reporter transcribing the record of this interview. Please wait until each question is 
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completed before you begin your response, and we will try to wait until your response is 
complete before we ask our next question. The stenographer cannot record nonverbal 
responses, such as shaking your head, so it is important that you answer each question 
with an audible, verbal response. 

We ask that you provide complete answers based on your best recollection. _ If 
the question is not clear, please ask for clarification. If you do not know the answer, 
please simply say so. 

| also want to remind you, as we do with every witness, that it is unlawful to 
deliberately provide false information to Congress. And you will have an opportunity to 
review the transcript once one is prepared. 

Let's begin, if | may, by asking you to briefly describe your professional experience 
leading up to and through your current position. 

Ms. Rapoport. I'm sorry, Robin, can | just make a quick statement for the record 
before we begin with questions? 

PF Of course. Noproblem. Go ahead. 

Ms. Rapoport. ae. the Department has made available to the committee, 
consistent with requests from the chairman, information and records that the 
Department would not publicly release. This includes information and records covered 
under the Privacy Act, personnel, and other personal privacy information, for official use 
only, intelligence and law enforcement sensitive records, and raw intelligence 
information. 

While the Department has made this information and records available to the 
committee, the Department continues to assert that such information and records 
provided to the committee and any discussion of such information or records during the 


course of the transcribed interview is not intended for public disclosure. 
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DHS is not waiving any protection, and for the purpose of the -- the purposes of 
administrative efficiency, and to promote constructive dialogue during the transcribed 
interview, is making this assertion at the outset of the transcribed interview to preserve 
all assertions of protection from public release or disclosure over information or records 
used or discussed during the transcribed interview. 

The transcript and any attachments are protected from further dissemination to 
the same extent as the documents and information they are based on. Please consult 


with the Department prior to any public release or disclosure. 


Thank you. 
— Thank you, Ms. Rapoport. 
EXAMINATION 
BY 


Q Sol will, for the record, I'll just repeat the question for you, Ms. Dobitsch. 
Can you or may you briefly describe your professional experience leading up to and 
through your current position. 

A Thank you. | have been in the intelligence community for about 15 years. 
Prior to that, | was in the Pennsylvania Army National Guard, where | did military 
intelligence. | joined DHS in 2019. Most of my experience focuses on Middle East and 
North Africa, with a specific focus on counterterrorism issues. 

Q Can you just run through, you know, the different positions that you had 
through DHS? 

A When | joined DHS in 2019, | first served as the counterterrorism mission 
manager in Intelligence Enterprise Operation. And in May of 2020, | was asked to fleet 
up as the acting deputy under secretary for Intelligence Enterprise Operation. | 


transitioned permanently to that position in January of 2021. 
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Q Okay. And is that your current title? 

A Yes, sir. 

Q Allrighty. Does that division, the intelligence division and enterprise, does 
that have an acronym? 

A It's commonly referred to as DUIEO, Deputy Undersecretary for Intelligence 
Enterprise Operation, or IEO. 

Q  |IEO. Okay. Was that your title over the summer of 2020? 

A | was in the acting capacity, but that was my title. 


Q_ Right. What about on January 6th, 2021, were you still acting at that 


A Yes, sir. 

Q_ Allrighty. Did you at any point serve temporarily in a higher capacity than 
the deputy under secretary? 

A No. 

Q Can you please just describe for us what you do as the deputy under 
secretary, what is your job description? 

A | lead most of the Office of Intelligence and Analysis intelligence functions, to 
include our collections capabilities both over HUMINT and open source collection. | also 
oversee our eight mission centers, five of which are substantive: the Transnational 
Organized Crime Mission Center, Counterterrorism Mission Center, Counterintelligence 
Mission Center, Economic Security Mission Center, and our Cybersecurity Mission Center, 
as well as three support elements: our Homeland Identities, Exploitation, Targeting 
Center; our Field Operations Division, which includes our individuals deployed throughout 
the U.S.; and our Current and Emerging Threats Center. | also oversee our analytic 


production. 
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Pp 


Who was your direct supervisor over the summer of 2020? 


> 


| recall that my direct supervisor was Mr. Brian Murphy and Mr. Horace Jen. 

Q And could you just tell us their positions at the time? 

A In the summer of 2020, Horace Jen served as the acting principal deputy 
under secretary for Intelligence and Analysis, and Mr. Brian Murphy served as the Senior 
Official Performing the Duties of the Under Secretary. 

Q _Isit fair to say that sort of hierarchy is Mr. Murphy first, and then the name 
you gave us previously, which I'm already blanking on, and then you? Is that the 
hierarchy? 

A Yes, sir. Brian Murphy, Horace Jen, then myself. 

Q Thank you so much. 

And who was your or what was the chain of supervision your direct supervisor, on 
January 6th of 2021? 

A _I'munsure of the exact positions at the time. [was the 
Senior Official Performing the Duties of the Under Secretary. And | believe, but | can't 
recall specifically, whether or not Melissa Smislova was the acting principal deputy under 
secretary at the time. | believe she was. 

Q_ If she wasn't, who would be? Is it between two people, or was -- are you 
thinking that that position might have been unfilled at that time? 

A It was either she was in the acing capacity or it was unfilled. But|do 
believe she was in the acting capacity during that time. 

Q = Andcan you tell me today the sort of, again, the hierarchy of who's your 
direct supervisor and then who serves above that? 

A Currently, Melissa Smislova serves as the Senior Official Performing the 


Duties of the Under Secretary. The Principal Deputy position is vacant. And|serveina 
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deputy under secretary position. 

Q What does -- and | don't think we've actually said it on the record -- the 
Office of Intelligence and Analysis, which we'll go on to say obviously called |I&A -- what 
does I&A do generally? What is its mission? 

A I&A serves a unique role in the Department and in the intelligence 
community. We really focus three -- on three primary missions. The first is unbridging 
the intelligence community and State and local, Tribal territorial and private sector 
partners. We ensure that nationwide bidirectional information sharing on homeland 
threat occurs, and then we provide a variety of intelligence support to those State and 
local partners. 

Beyond that, we produce tailored analysis for our Homeland Security 
stakeholders. We collect and analyze information, including DHS holdings, to address 
intelligence requirements of DHS, our Federal partners, and our State, local, Tribal, and 
territorial and private sector customers. And this spans the full spectrum of threat to 
the homeland, including cyber, terrorism, malign influence activity, transit border threats, 
and economic security threats. And we strive to put out our analysis at the unclassified 
and secret level to deliver to the widest group of Homeland Security stakeholders. 

Lastly, we serve as a nexus between DHS and the intelligence community, bringing 
what information and intelligence the DHS intelligence network can bring to bear on 
national security efforts and threats, to include providing data analytics, tool, techniques, 
and solutions to enable the Department and the intelligence community to accomplish 
our national security and intelligence mission. 

Q_ Itis a member of the intelligence community, correct? 

A Yes. 


Q What is its relationship, if any, with the fusion centers across the country? 
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A I&A enables the fusion centers by supporting their intelligence efforts. We 
primarily rely on our staff that are deployed throughout the fusion centers to enable the 
full spectrum of the intelligence cycle, to include collection analysis and information 
sharing. 

Q What does the Current and Emerging Threats Center do, and how does it fit 
within the structure of I&A? 

A The Current and Emerging Threats Center, known as CETC, reports to me as 
one of the eight mission centers that fall under my purview. The Current and Emerging 
Threats Centers -- Center has three main functions, the first being responsible for 
managing requests for information from the full spectrum of our stakeholders and 
partners, to include from the intelligence community, State and local partners in the 
Department. Their second primary focus is serving as a watch function, ensuring broad 
situational awareness among our partners and our senior leadership on new and 
emerging threats. And their third function is leading I&A open source intelligence 
collection activities. 

Q__ Sois it -- is Open Source Collection Operations -- and I'll need you to 
pronounce, | guess, the acronym for me -- does that fall under CETC? And how does it, 
the open source collection operations, what does it do? Right. What is its mission? 

A So the Open Source Collection Operations branch, or OSCO, is a branch in 
the Current and Emerging Threats Center. Its mission is to drive intelligence collection 
derived from publicly available information on key collection requirements and 
intelligence gaps determined by our analysts in the IC to help us better understand the 
threats to the homeland. 

Q What does the Counterterrorism Mission Center do, and is that structurally 


also one of the eight mission centers under CETC? 
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A So CETC is one of the eight that falls under me. It's separate. The 
Counterterrorism Mission Center is equal, as it relates to being on the organizational 
structure. So they're each -- there are two of the eight mission centers that | oversee. 
The Counterterrorism Mission Center, also known as CTMC, drives primarily collection 
and analysis on the full spectrum of counterterrorism threats facing the homeland. 

Q Thank you for that clarification. | misspoke. 

And, lastly, can you tell me what the Field Operations Division does and, again, 
where it fits within the structure? 

A The Field Operations Division, or FOD, is the third of eight mission centers 
that | oversee. Their primary mission is to enable our Homeland Security stakeholders in 
the field, focused on the full intelligence cycle, to include collection, analysis, and 
dissemination of intelligence to the partners, as well as engaging in association and other 
engagement meetings to, again, maintain strong, robust relationships with the State, 
local, Tribal, territorial, and private sector partners. 

Q_ _Inyour role, does raw specific intelligence come across your desk? Is it 
elevated to your level regularly? 

A | regularly see disseminated raw intelligence collection once it's serialized. 
| do not regularly view raw intelligence collection before it is officially disseminated and 
serialized. 

Q Does that mean that it's -- you see the analysis as well or -- you see the raw 
intelligence as part of an analytical product, is that typically how it comes across your 
desk? 

A No. | review both raw and finished intelligence as it relates to all threats to 
the homeland. 


Q__Isthat by policy and procedure? So if something is going to be 
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disseminated in an analytical product, do you ensure to both review the product and the 
underlying raw intelligence yourself? 

A No. 

Q Okay. Can you explain that to me then, how -- under what situation you'll 
look at the raw intelligence apart from the analytical product? 

A | look at raw intelligence once it is serialized and disseminated to customers. 
So after it's finished and completed, just as | look at analysis in our finished intelligence 
production primarily after it is reviewed, disseminated, and completed. 

Q  |see. So it could be disseminated just raw without any sort of analysis 
attached to it. And in that case, if it is being shared externally, you will have reviewed it. 
Is that right? 

A | do not review raw intelligence before it's disseminated. 

Q Okay. | think I'm having issues understanding. Well, let me ask you this. 
What level of -- 

A | am not part of the review process before raw intelligence is formally 
disseminated. | read it as a customer after it's disseminated. 

Q  Gotit. Isee. The difference -- and it's easier for me if you distinguish, 
when you're making a distinction with me, what part of the sentence you're 
distinguishing. So it's the before is the part that you were in disagreement. _ It's you 
review it, but you review it afterward, after the dissemination. 

A Once it's disseminated, yes. 

Q- Thank you. 

What level of involvement -- drafting, reviewing, approving -- do you play in the 
production of or creation of intelligence products? 


A Can you clarify what type of intelligence? Are we talking about raw 
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intelligence or finished intelligence? 

Q Let's do finished intelligence. 

A | do not play a role in the drafting, reviewing, or publication of finished 
intelligence products. | have the designation that | formally approve those products in 
our policies, but that duty is delegated primarily to my office of the research director, 
which is a senior leader who focuses primarily on reviewing and disseminating those 
products. 

| sometimes review products when they are of a high profile or a high visibility 
nature, meaning that there's a significant or imminent threat, or in a case where we 
might have some reduced staffing that requires my support to help them provide that 
review. But ona day-to-day basis, | typically do not review finished intelligence 
products before they are disseminated. 

Q Just to clarify, those exceptional circumstances that you listed for me, those 
would be reviewing before dissemination. Is that correct? 

A Yes. 

Q_ This relationship that you've just described for us how regularly you see, you 
know, raw intelligence that is being disseminated and then how regularly you have either 
eyes or review or preapproval on intelligence products, is it -- did it stay the same, in 
essence, throughout your tenure, from the summer of 2020 through January 6th to 
today? 

A | almost never review or see raw intelligence before it's formally 
disseminated. Between the summer of 2020 and shortly after 6 January, | reviewed and 
approved every open source intelligence report that was disseminated by I&A prior to its 
dissemination. 


Q  Canyou repeat that actually? | missedthat. You said -- can you repeat 
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the whole thing, please? 

A | almost never review raw intelligence reporting before it is officially 
disseminated. During the timeframe that you had identified, between the summer of 
2020 and shortly after 6 January, | reviewed and approved nearly every open source 
intelligence report that was disseminated by I&A. 

Q And that would be preapproveds before dissemination? 

A Prior to dissemination. 

Q Okay. And that was not true before the summer of 2020, and it is not true 
since, in the days following January 6th. Is that right? 

A | think the official memo came out in spring of 2021, so | can -- like, I'm just 
recalling from my recollection it was, | think, March of 2021, but from around that 
timeframe, we instituted a policy for review of open source intelligence reports to which | 
removed myself from that process. So it was sometime around March where | stopped 
reviewing it. And prior to December of 2020, | did not review open source intelligence 
reports prior to their dissemination. 

Q Why before the summer of 2020 did you not do that? 

A It's not typical for an individual at my level to review raw intelligence 
production. It's not part of the process. 

Q = And what made it typical after the summer of 2020? 

A After the summer of 2020, it was determined that a process was not in place 
officially for the review and dissemination of open source intelligence report. And 
following the release of three open source intelligence reports that had detailed 
information on American journalists, | believe it was my -- my responsibility to ensure 
that our open source intelligence reports received the proper review and oversight until a 


more formal process was established and put into place. 
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Q Was that a policy or procedure that you undertook or did it come from some 
sort of written guidance from anyone? 

A | undertook it, and | disseminated the policy in March of 2021. 

——> Do you have a question? 

Ss Ma'am, | just want to follow up on a question that my colleague 
asked you earlier. | think in response to one of his questions, you said you almost never 
review. And1|was wondering if you could describe for me the circumstances that qualify 
for the few times that you have. 

So it sounds like it wasn't a blanket no, but you said you almost never review. 

I'm just trying to get a sense of what you mean, what constitutes the circumstance where 
you would, in fact, do that review? 

Ms. Dobitsch. When | talk about raw intelligence reports, just to clarify, it's more 
than open source intelligence reports. We also disseminate field intelligence reports 
and intelligence information reports. So we have multiple products that we disseminate 
that are considered raw intelligence. And so I'm speaking in the totality of what we do. 

In those rare circumstances, it's often because if -- again, it's a high profile or high 
visibility issue. An example would be if we were going to disseminate an intelligence 
report on Russia/Ukraine, I'd want visibility so that | can be prepared to discuss or share 
that information with our -- 

Hit appears your video -- and your video has cut out, Ms. Dobitsch. 

Ms. Dobitsch. Are we back? 

ESV ¢ can hear you, but we can't see you. 

There we go. 

Ms. Dobitsch. | apologize. We're ina SCIF, so every 15 minutes, the camera 


shuts off, and we have to push a button to restart it. 
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BEE No problem. 


So you were saying an example of a high-profile situation would be something like 
on Russia and Ukraine. Is that correct? 

Ms. Dobitsch. Yes. Typically, if we know that a report is going to be highly 
visible, likely to be shared with very senior leaders, | ask my team to give me a heads-up 
that that dissemination is forthcoming so that | can be prepared to brief that information 
to our customers. 

Thank you, ma'am. 
FFT 

Q Can you describe the difference, if there is any, between an open source 
intelligence report, or an OSIR, and an intelligence information report, an IIR? 

A Open source intelligence reports contain information derived from publicly 
available information. Intelligence information reports are derived from I&A's 
perspective almost entirely through overt HUMINT, which is our authority to collect 
information from human sources. 

Q Before the October 30, 22 -- 2020, excuse me, memorandum put out by the 
Under Secretary for |I&A at the time -- and it's exhibit 6 -- was the decision whether to 
draft and put out an OSIR between an individual analyst and his or her supervisor? Did 
it need to go any further up at that point? 

A Prior to the October 2020 memo being disseminated, as | stated earlier, 
from the summer of 2020 up until after January, | reviewed all open source intelligence 
reports before they were disseminated. 

Q = Andcan you explain to me -- do you know what dates when you put in place 
that policy? 


A It was shortly after the dissemination of the open source intelligence reports 
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relating to the journalists. So based on my recollection, | believe it was sometime in 
August or September of 2020. 

Q  Sothen could you describe for me briefly, then, after that memo, who 
additionally had to review and sign off on OSIRs, other than it sounds like, you know, the 
drafter, his or her supervisor, yourself? Did it add any other layer of review, and what 
was it? 

A According to the exhibit that you provided, the product, if it was specific to 
reporting related to elections, it went through our Collections Management Division, as 
well as our Intelligence Law Division and our Intelligence Oversight Office prior to 
dissemination. 

Q Is that your understanding of how it worked in practice following the 
memorandum? 

A Yes. 

Q Okay. And did that remain the case up to and through January 6th? 

Yes. 

Q What sort of coordination is there between I&A and other Federal 
intelligence agencies like the FBI? 

A Can you be more specific in terms of what -- on what, coordination on what? 

Q Yeah. What relationship, | mean, what sort of communication? Is there 
coordination in terms of the sharing, collection, consuming of intelligence between you 
and other members of the intelligence community? 

A We coordinate and collaborate every day multiple times a day with most of 
our few stakeholders across the intelligence community. 

Q What about with law enforcement and the intelligence shops within those 


law enforcement agencies? 
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A Every day and multiple times a day. 

QA Washington Post article characterized the historical reputation of I&A this 
way, quote, The Intelligence and Analysis Office has for years been the butt of jokes 
among larger, more established agencies like the CIA and the FBI who liken it to a team of 
junior varsity athletes. The DHS office produces reports that are largely based on 
unclassified, often public sources of information that current and former officials have 
said are of limited use, end quote. 

Putting aside the substance of the critique, does this, in your experience, 
accurately characterize what you've heard about the perception of I&A among those 
other organizations? 

A Absolutely not. 

Q Can you expound onthat? Tell me what your experience has been. 

A Having served in multiple intelligence community organizations prior to 
arriving at DHS, the perception with that DHS had a unique and very distinct and different 
customer from other intelligence community members and focused primarily on serving 
customers like State and local partners, for which it's statutorily required to share 
intelligence information, which is different from those intelligence community members, 
what | found serving those positions, that in most cases, those intelligence community 
members had no idea what I&A did on a daily basis and did not understand their mission, 
their purview, or their customer. 

Q_ So that still sounds a little bit about the substance of the critique. Had you 
heard the perception that is characterized in the quote | read? Had you come across 
that perception? 


A No. 
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A No. 

Q  Somy reading is the first time you had ever heard that anyone had made 
those sorts of comments about I&A? 

A Yes. 

Q I'd like to start with the summer of 2020. Can you list your reporting 
requirements -- I'm going to say at that time. That doesn't necessarily imply that they 
changed, and we'll get there, but can you list -- but | want to make clear I'm talking about 
December of 2020 -- can you list the reporting requirements, of which | think there are 
three. Is that right? 

A I'm not aware of reporting requirements related to the summer of 2020. 

Q Okay. What are they today? 

A I'm not sure what you're referencing. We drive intelligence based off of 
collection requirements for which we have hundreds. 

Q Yeah. Sol'm talking about the requirements or thresholds that need to be 
met in order for something to be disseminated, for a report to be disseminated. 

A I'm not aware of a reporting requirement. In order fora report to be 
disseminated, it has to be within our authorities, our guidelines, and answer a collection 
requirement. 

Q_ Allright. So, potentially, I'm misusing terminology, and so | don't want to, 
you know, worry about semantics. So you tell me, what -- the OIG listed these three 
things, and you tell me what they are characterized as, what you would callthem. That 
the -- whatever intelligence the analyst is reviewing contains true threats or incitement to 
violence, not hyperbole; that it provides -- or that it provides information that enhances 
understanding of known threat actors; or that it includes information that demonstrates a 


risk of violence during a heightened threat environment. What are those? 
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A Those are Attorney General guidelines. There are authorities and abilities 
for disseminating intelligence. 

Q Okay. Sois it fair to say -- 

A For collecting and analyzing and disseminating intelligence. 

Q Repeat that last part. I'msorry. We talked a little bit over each other. 

A These are the Attorney General guidelines that are provided for I&A's 
collection analysis and dissemination of intelligence. 

Q Okay. Doall of these conditions need to be present for the dissemination 
of intelligence? 

A No. 

Q Does one at least need to be present for the dissemination of intelligence in 
order to follow the guidelines? 

A Yeah. Although this guidance from our Intelligence Law Division has 
changed over time. 

Q- Right. And so is it okay if | use a shorthand, guidance for dissemination? 

A Sure. 

Q_ Okay, perfect. So what was the -- were the three things | listed, was that 
the guidance for dissemination over the summer of 2020, and, if not, can you tell me 
what it was? 

A The guidance for dissemination was -- primarily over the summer of 2020 
was typically all three of these, with a heavy focus on providing intelligence during a 
heightened threat environment. 

Q Okay. And so we talked about how, you know, all three are 
not conditioned precedence for the dissemination. That it's a disjunctive, it's or. But 


that's interesting, | mean, when you say with a heavy focus onthe third. What does that 
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mean in terms of, you know, the disjunctive, that it can be one, two, or three? What 
does it mean that there's a heavy focus on one of them? 

A From a leadership perspective, it was identified early on in the summer 
of -- spring through summer of 2020 that we were operating in a heightened threat 
environment. And | think there was a general understanding that that drove a lot of the 
priorities as it related to the collection of intelligence. 

Q_Isee. Sois it fair to say you can still disseminate based on just, one, being 
present, based on just, two, being present; but what you're telling me is that, given that 
number three had been designated the time period as a heightened threat 
environment -- | don't want put words in your mouth. | want to say it's easier -- but it is 
a route that maybe was either more deployed or more accessible given that designation. 
Is that fair? 

A _ That was the perception at the time, yes. 

Q  Andsol want to ask you about that, because you said that that sort of 
designation -- how did that designation happen? Wasit written? Was it formalized in 
some way, or was it a perception? 

A | think it was written and perception. Our Intelligence Law Division issued 
and developed several job aids for our officers, to include one that looked at how we 
collect and analyze information looking at national monuments, as well as what is 
referred to as the Portland job aid. So it was codified for our collectors. And then 
from a perception standpoint, the leadership at that time communicated to the 
workforce that we were facing a heightened threat environment. 

Q Dovyou recall when that guidance about the monuments came down? 

A My recollection is that those aids occurred earlier in the summer, possibly 


around the June, July timeframe. | recall that the Portland job aid was disseminated 


24 


25 


22 


before I&A deployed personnel to Portland. 

Q You said that leadership sort of inculcated or reiterated this period as being 
a heightened threat environment. Were you a part of the leadership that did that? 

A | did not communicate that, but | was part of that leadership team, yes. 

Q  Dovyou recall who in particular was sort of fomenting or reiterating that 
position, that understanding? 

A The Senior Official Performing the Duties of Under Secretary, Mr. Brian 
Murphy, and the Acting Principal Deputy Horace Jen were primarily in charge of 
directing/dividing operations during this timeframe. 

Q Did you get a sense -- because you sort of distinguished it for me both the 
perception and the fact that it was codified, it was a written guidance -- did you get the 
sense that they were doing that or that your leadership team decided to do that because 
of the codification, or that separate and apart, that was their, | guess, opinion as to 
whether you were in a heightened threat environment or not? 

A _ The leadership determination drove the codification of that guidance by the 
Intelligence Law Division. 

Q Thankyou. That helps me. 

What was your opinion about that? Did you share in that opinion that it was a 
heightened threat environment? 

A Yes. 

Q Can you -- you know, | want to make a distinction also. I've been calling it 
guidance for dissemination. You talked about collection also. You used guidance for 
collection and dissemination. 

Do those three conditions, do they govern -- | understand it governs your ability to 


distribute information via intelligence products. Does it limit what you can see or 
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monitor -- and I'm, you know, | know you have certain restrictions, you know, about 
things being publicly available, that sort of thing. | assume that that is all met. That 
those conditions are met. 

I'm trying to understand if what you see is at all limited, as long as every other 
condition is met, by these three -- these three guidance requirements. 

A These three that are noted in the OIG report are just a snapshot of the 
overarching guidelines which drive the full, again, operations of |&A. There are other 
aspects where we must first identify that the activity -- the intelligence activity that we're 
conducting meet the national departmental mission. So these are just a snapshot of 
what we look to to make determinations about any intelligence activity that we conduct. 

Q_ Right. So my question is, in essence, can you see, can you monitor 
intelligence that does not meet one of these three requirements? 

And maybe | should use "information" instead of "intelligence," but I'm trying to 
get at whether these three requirements constrain what you're able to see, read. 

A It's threat-specific. There are instances where our open source collectors 
are looking at threats that are not violent in nature. So an example of these borderline 
blunt (ph) activity. Andso these are very specific to an environment in which we're 
looking for violent threats. And in that perspective, particularly, yeah, our 
counterterrorism mission, these are the primary guidelines for which we would also 


monitor reporting. But they're not exclusive. 


<_< | If | could ask. 


ME Go ahead. 
BY as: 
Q So maybe another way of asking the question is: Are the three criteria, the 


three guidelines listed, limiting in any nature, | think is what we're trying to understand. 
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Because when | hear the term "guidance" or "guidelines," it doesn't have the force and 
effect of a statute or regulation, and it's somewhere in between that and policy. 

So we're trying to understand, or at least I'm trying to understand, how 
constraining are the guidelines on what you do day to day? 

A From my perspective, it's not the guidelines that are necessarily constrained; 
it's the interpretation of those guidelines. And those interpretations have changed over 
the course of the last several years, which has created confusion amongst our workforce 
and our leadership team in terms of how we apply the Attorney General guidelines to 
what we do every day. 

Q  Anddoes ILD play a role in helping senior leadership interpret those 
guidelines? 

A Yes. They are the primary office for which we make those determinations 
about how we apply those. 

Q_ And from your perspective, has the interpretation of the guidelines based on 
a guidance provided to you by ILD changed in anyway from the summer of 2020 through 


January 6th until now, or has the interpretation remained consistent? 


A It's changed through nearly every experience over the last several years. 
Q Okay. 
oy as: 
Q | just want to close the loop, put a pin onthis. I'm trying to understand -- | 


understand that these -- one of these conditions needs to be present in order to 
distribute information via intelligence products. | want to understand that when you 
are monitoring, let's say, social media that is otherwise compliant -- | know you 
mentioned there are, of course, other guidance and restrictions on, you know, what you 


can do, including, you know, | believe, not -- you know, private chats and 


24 


25 


25 


trying -- infiltrating those, that would -- assuming that everything else is met, can you 
continue to monitor, let's say, social media activity even if what you are reading does not 
constitute a true threat or incitement of violence, you know, it's not a heightened threat 
environment, and the information that you're reading doesn't at the time enhance your 
understanding of known actors? _|'m trying to understand if those three limit what you 
can read, what you can monitor, what you can see. 

A So I'll be the first to admit that there are a lot of exceptions to these 
guidelines and the extent to which we apply them. So it makes the question you're 
asking difficult to answer. And so what | would say, that in many circumstances, it's 
specific to the nature of the specific information that the collector is looking at, the 
context in which the collector is looking at that information, and then the nature of the 
information itself. 

So that is why it is difficult to get a singular answer in that there are a lot of 
exceptions with how we apply these guidelines based on the information at hand, the 
circumstance in which the information is obtained, and then the context in which the 
information exists. 

Generally, | would say that in terms of monitoring open source information that is 
publicly available, generally, as it relates to the specific focus of looking at threats of 
violence, we would -- we would need at least one of these to be present for us to monitor 
it, generally. 

Q__Ireally appreciate that answer. And so if you would assist me if, you 
know -- if the question is difficult for a reason, please let me know. | very much 
appreciate that answer. | think that very much did answer the question. 

So back to just now, you know, guidance for dissemination, right? We 


understand that this, you know, as we talked about, one of these should be present. 
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Does this guidance limit your ability to put together a threat picture or landscape in the 
form of a bulletin that does not specifically reference any one particular piece of 
intelligence? 

So | understand that you can't distribute information via intelligence products. 

I'm trying to understand if the specific intelligence is not mentioned in the product but 
that it informs, let's say, you know, across the board, can it inform an intelligence bulletin 
or would that be verboden? Would that be restricted, prohibited? 

A Typically, in terms of the guidelines we use, the IC directive is another 
guideline we use to disseminate finished intelligence production, which would, in this 
case | think what you're referencing is a bulletin, we would consider that finished 
intelligence. Generally, the best practices and the guidelines require evidence to 
support your analytic assessment. And so while information that we're seeing online 
can inform that analysis, the preference is that information be documented in some way, 
primarily through an OSIR, so that it can be used as evidence to support our assessment. 

And so when information doesn't meet one of these thresholds, generally, our 
analysts, like | said, it informs their understanding, but it is not typically included ina 
finished intelligence product, and it does complicate our ability to produce things like a 
bulletin. 

Q_ Thank you. 

And then | understood you to say that that's the, you know, preference, the strong 
preference. Do you recall occasions when, you know, no OSIR with actual particular 
intelligence was put out but yet the intelligence, the sort of information was used to 
generally put together a bulletin? 

A | don't recall anything specific. Most of the time when we produce finished 


intelligence where we don't have that document, in reporting it, often an assessment that 
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articulates that we do not have information on a specific threat. So that's the most 
common example where we don't have the information. We often put out finished 
intelligence that articulates that we lack information on that. 

Q  Gotit. The threat assessment put out by Capitol Police on January 3rd, 
have you had an opportunity -- as you sit there today, have you seen that document 
before? 

A No. 

Q Okay. And 1 didn't mean to hide the ball. | didn't provide it as an exhibit 
because it's -- | didn't know whether you had seen it before or not. Sol appreciate that. 

Tell me about your ability to save or archive information. Can you retain it fora 
period while your analysts are deciding whether it meets the reporting requirements? 
How long do you have -- if that's true, how long do you have until it must be deleted if it 
is determined that it does not meet the requirements? 

A | don't know the specific answer to that. | know that we are able to 
capture, retain the information for a period of time for which our collectors or our 
analysts can make a determination as to whether or not that information meets 
collection requirements and our guidelines for reporting, but | don't know how long that 
time is. 

Q Okay. Sowe talked about this, right, the departmental guidance released 
the summer authorizing the monitoring of social media posts as well as the use of public 
information sources to keep tabs -- this is language that -- reporting language on 
individuals or groups that department says may, quote, damage or destroy any public 
monument, memorial, or statue, end quote. 

Can you describe how that departs, if at all, from your -- from before, from how 


your restrictions operated traditionally? 
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A | think that as it relates to reporting on national monuments, generally, prior 
to that legal guidance being disseminated, generally, the perception was that national 
monuments don't necessarily fall into the critical infrastructure category for which we 
have our authority to produce intelligence and analysis. There was not a focus on 
collecting that as it relates to our critical infrastructure and key resources mission. 

And so there were questions raised when there were threats of violence 
associated with the taking down of certain statues or monuments. Andso the 
leadership asked the Intelligence Law Division to clarify the extent to which those were in 
our mission space. 

Q Did that affect how long you were able to hold on to or archive these 
materials, these monitoring of social media posts and use of public information sources, 
that you know of? 

A No, I'm not aware that there was a change as a result of that guidance. 

Q Do you know if dossiers were maintained on these individuals or groups as a 
result of this guidance? 

A Not specific to the national monuments. I'm not aware of any dossiers. 

Q Okay. And does that mean -- are you saying not specific because the ones 
that you're aware of relate to the American journalists that you talked about earlier? 

A No. That was also not connected. Federal (ph) and national monuments, 
I'm not aware of any specific intelligence reporting that isn't serialized. So ifthere'sa 
report, it's likely serialized. I'm not aware of any information that wasn't serialized that 
was maintained in any way on that specific issue. 

Q Okay. What about on just individuals or groups over the summer? Were 
dossiers maintained? They used a phrase, keep tabs on individuals or groups. I'm 


trying to understand, from your perspective, how that practically worked. 
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A I'm not aware that I&A officers captured and checked dossiers on 
individuals. Typically, again, we do not keep information that doesn't meet the 
requirements for reporting. So individuals -- the only thing | can think of that relates to 
your question is the production of our operational background reports, or the 
OBIRs -- OBRs, where individuals who were arrested on charges in Portland were 
evaluated and analyzed to determine whether or not a network existed to commit the act 
of violence that were taking place there. 

Q Okay. We've talked about how the differing interpretations of the 
guidance for dissemination -- that's the phrase I'm using -- have changed over time. My 
question is: Formally on paper, have they amended or changed in that time? 

A Yes. 

Q Okay. Let's talk about how, because -- so you told me, over the summer of 
2020, that there were these three with a particular focus on number three. How has 
that changed in the time period between the summer of 2020 and January 6th, if at all? 

A Sure. Soto start, we both say believe certainly the legal guidance on the 
monuments was rescinded. And | believed the guidance on the Portland job aid was 
also rescinded. So those were rescinded since they were issued. Additionally, after 
the summer of 2020, all of I&A was retrained on our oversight guidelines and authorities. 
And, specifically, our open source intelligence collectors were briefed only -- or trained 
only on true threats and incitement rather than the other two aspects noted in the OIG 
report, which is documented in the training materials provided by our Intelligence Law 
Division. And since then, our -- since January 6th, the guidance has now changed back 
to an increased focus on what we would call risk and vulnerabilities rather than just 
true threats and incitement. 


Q Okay. When you talked about through January 6th, it sounded the changes 
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were about training and interpretations. | guess I'm trying to ask these three. Was 
there official change in language with the requirements, not their interpretation, not how 
they're trained, just literally formally amended or changed in some way? One of the 
requirements dropping off entirely, adding a new requirement, have these three stayed 
constant in the formal, written capacity? 

A My understanding is there's no formal written capacity that details these. 

Q Are they not documented anywhere? 

A No. | think outside of the Attorney General guidance, which are not this 
specific, I'm not aware of guidance that's been formally disseminated by our Intelligence 
Law Division or others that articulate these specifically. The formal aspects were 
provided in slides via training to our workforce. 

Q_ So then if it's fair, you said, you know, you talked these three being present 
at the summer of 2020. These were understandings. These were not the language 
that you had seen written down previously outside of slides in a training? 

A The only document | recall that hinted at these aspects but it was still 
primarily focused on true threats and incitement was a 2018 memo that focused ona 
particular threat that we had seen against departmental personnel and the doxing of 
those personnel that was very specific to that timeframe in that threat from 2018, from 
which most of our officers in our Intelligence Law Division extrapolated to other problems 
that -- because there was a lack of written guidance on that. 

Q The OIG report obviously sort of puts these three out as a little, you know, 
block of three requirements. Did you see them -- before the OIG report, did you see 
them as a sort of block of requirements? | know you said that there are others, but | 
guess analytically, is this the way that you and others within I&A conceived of the 


guidance for dissemination, that these sort of three are sort of the three leading kind of 
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requirements, one of which needs to be met in order for information to be shared via 
intelligence products? 

A | think it's changed over in the course of the last several years. As | said, | 
think, generally, there was an understanding that three -- these three exist. Though 
throughout the summer of 2020, the focus was on providing what | would consider to be 
risk and vulnerability information related to the heightened threat environment. 
Whereas, after the summer of 2020, there was a very narrow focus on true threats and 
incitement. And now we've kind of circled back to a more measured approach that 
works at all three. 

Q Okay. I'm going to get to that narrow focus. I'm going to wait until your 
camera comes back on. Unless the court reporter doesn't mind. 

Okay. It's back. 

A _ Thank you for the heads-up. 

Q Ofcourse. No problem. 

So then is it fair to say that the three were still conceived of as the three, they 
were on the minds of analysts, you know, post the summer heading into January 6th, but 
as you mentioned with inter -- the focus changed. So as where you were highlighting 
that the focus was on number three over the summer, the sort of requirement that was 
doing a lot of the work -- you called it a narrow focus -- since had been that first 
requirement contains true threats or incitement to violence. Is that a fair 
characterization? 

A | think after the summer of 2020, there was a lot of confusion about who 
could determine a heightened threat environment. In some of the training that was 
provided to the workforce, it was not clear. There were references that, you know, the 


publishment of a National Terrorism Advisory System Bulletin, which is what the 
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Department uses to raise the threat alert on a topic, was not sufficient alone to 
determine the heightened threat environment. And so there was not a good 
understanding of who and how that determination was made and who had the authority 
to declare that. 

So not only was it not emphasized, it was not clarified, and following the summer 
of 2020, kind of what a heightened threat environment was and who was able to make 


that determination. 
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Q_ And that sort of explains why maybe number 3 fell a little bit less out of 
favor, why it was less focused on. What about number 2? Because you said there was 
a narrow focusoni1. What happened on number 2 that the focus remained on number 
1 as opposed to number 2? 

A Number 2, | think, is a little bit more vague. | think that, again, known 
threat actors is difficult. Oftentimes we don't know who the threat actors are, 
particularly as it relates to the open-source environment. 

Much of the threat reporting we're seeing is coming from anonymous individuals 
or individuals for which we do not know who they are, and so that, it doesn't necessarily 
apply, | would say, in the open-source environment as much as the other two do. 

Q_ And you used the phrase "know." Is your understanding that -- 

A Known, known. 

Q Known, right. 

A Known threat -- 

Q Yes. It's just that, in your answer, you said, we don't know whether -- we 
don't know necessarily the identities of people obviously on -- necessarily on social 
media. But! want to know, | guess I'm trying to figure out how much work the word 
"know" is doing inthat. So if -- and | know this is a hypothetical, but help me work 
through it. -- if there is a social post where the person is using language that is known to 
be used, let's say, by the Proud Boys, right, certain phrases, P-E-D-E, -- | don't think | know 


how to pronounce it, it might be "peedy" -- but P-E-D-E or, you know, | do, | believe, being 
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sort of a before | do, meaning, before | undertake violent action; is it your understanding 
that that could be used to figure out whether that's a known threat actor, given that, you 
know, potentially obviously the Proud Boys have been known to engage in violence in the 
past or -- or because it is, you know, the person didn't, in my hypothetical, affirmatively 
say they were a Proud Boy, that that may not be a known threat actor given just the fact 
that they're using just those phrases? 

A Yeah. | think it's dependent on the circumstance, but in the case where an 
individual is only, alone, using language, we would not characterize that as a known 
threat actor. 

Q What about -- 

A Orif there's an individual who states -- 

Q Goon. 

A -- that they are a member of the Proud Boys. 

Q Okay. Gotit. So you feel pretty comfortable that if they expressly say 
something that intimates, you know, that they are a member of the Proud Boys expressly, 
that that number 2 would be triggered, but that language might not? 

A Yes, | would say it aids in the determination to the extent to which we would 
be reporting on that information. 

Q Okay. Thankyou. Sol want to ask you about, | want to stick to the 
summer -- and we'll switch obviously to January 6th in a moment -- you talked about the 
I&A producing intelligence reports about the work of American journalists covering 
protests in Portland, Oregon. 

Let me ask you, for the record, did those disseminated products, the ones on the 
journalists, meet the reporting requirements? And |I'msorry. | was supposed to use 


the phrase "guidance for dissemination." Did it meet the guidance for dissemination? 


24 


25 


35 


A That's a difficult question, one, because the reporting on those American 
journalists does not fall within this category of violence. The determination that was 
made as it relates to the journalists is focused on the leak of government information, 
which is something we've reported on in the past. 

Q Well, it's my understanding that, at some point, the CETC director reviewed 
366 OSIRs released between May 25th and August 4th and found that 23 were recalled 
for not fitting the guidance for dissemination. Is that right? 

A Not -- those are -- they didn't meet collection requirements, which is distinct 
and different from the oversight guidance and Attorney General guidelines. The 23 that 
were identified did not answer a collection requirement. 

Q_ I|see. 

A But they met the guidelines for -- they met the guidelines for dissemination. 
They did not answer a collection requirement. 

Q Okay. It's your understanding that all 366 did meet the 
dissemination -- guidance for dissemination? 

A I'm not aware that a determination was made that we violated our oversight 
guidelines by disseminating those. 

Q Okay. Did the products meet collection requirements in your mind? 

A | did not personally review those OSIRs. | did review -- | asked -- are we still 
on? 

«Still there. 

Ys: 
Q Yes, | hear you. 
A Okay. | asked the then CETC director to do that review of all the OSIRs. | 


reviewed his analysis of that and concur with his findings based on what he provided me, 
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but | did not independently review each of those OSIRs. 

Q Okay. So, generally, as it relates to the social justice protests over the 
summer, do you believe I&A followed the guidelines for dissemination appropriately? 

A Yes. 

Q Andis it fair to say, because you talked about a focus, the designation of it 
being a heightened threat environment, that that -- that requirement was doing a lot of 
the work, that that is -- that is why you believe, by and large, the guidance for 
dissemination was followed over the summer? 

A Yes. 

Q _sIsit fair to say that were there not a heightened threat environment 
designation, the number of disseminated reports would have been far fewer? 

A | think that was one contributing factor. | think a lot of the decision to 
produce as much as we did was based on leadership direction to identify threats to law 
enforcement that were operating in Portland as part of our public safety and security 
responsibilities. 

Q_ Tell me about that leadership direction. What was it? 

A At the time, the Department was deploying personnel to secure national 
monuments and obviously to provide protection to Federal facilities throughout the 
country, and the leadership at the time believed that it was INA's mission to make sure 
that we provided intelligence support to our Federal partners and to our State and local 
partners, who were encountering these threats of violence throughout the summer. 

Q And you mentioned that this was direction from leadership. Does that 
include yourself? Was that direction that you helped inculcate? 

A | did not provide that direction, though | obviously oversaw the offices that 


were responsible for implementing it. The direction came from Mr. Murphy and 
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Mr. Jen. 

Q Did you agree with that direction? 

A | didn't feel comfortable at the time, understanding our authorities and 
responsibilities in this mission space. When | was asked to fleet up as the deputy under 
secretary in May of 2020, | had less than 9 months of experience working in DHS, I'd 
never worked the domestic mission before, and | had almost no time in the deputy under 
secretary role. Andso| didn't believe that | had the knowledge, experience, or 
background to make those determinations at the time. 

Qs Inhindsight, given now the full breadth of your experience, do you agree 
with their assessment? 

A | believe that we were facing a heightened threat environment in which we 
were responsible providing -- to providing support to our Federal, State, local, Tribal, and 
territorial partners, to enable their ability to counter those threats. 

| think that our resources were not positioned in a way for us to -- just to 
accomplish that mission. We were not set up ina way to serve in that capacity. Even 
if it falls in our authorities, that had not traditionally been our focus. And so, in 
retrospect, | would say that we were not resourced or positioned or trained to accomplish 
the mission we were asked. 

Q But you did feel as though, had you had those resources and that training, 
that it was -- that, you know, the belief that it was a heightened threat environment was 
a correct, accurate belief? 

A Yes, | believe we were facing a heightened threat environment in the 
summer of 2020. 

Q Let me ask you about a table that's reproduced in the OIG report on page 28. 


In it, they found there were more probable indicators of escalation of protest-related 
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violence for January 6th than for over the summer, and at least in the chart as it's 
depicted, it's somewhat lopsided as far more probable indicators on the January 6th side 
than it is over the summer. 

Given your belief that there was a heightened threat environment over the 
summer, can you talk to me about that, what you think about that chart and what it 
means at least relationally from there, if you're looking at that as a sort of indicator, that 
wouldn't be as heightened certainly as for the lead-up to January 6th? What do you 
think about that? 

A So the heightened threat environment was just, as | said, a subset to the 
more overarching leadership direction. Part of -- or a major driver of why we conducted 
the activities we did over the summer was the leadership direction to support the Federal 
and DHS partners who were engaged in protecting Federal facilities and other key 
resources and critical infrastructure, to inform them of information related to threats. 

So the heightened threat environment was the baseline in terms of the guidelines, 
but the leadership direction was to prioritize identifying and producing intelligence that 
helped these partners mitigate the violent threats they were facing throughout the 
summer. 

The distinction in January 6th was that we were facing a heightened threat 
environment, but we lacked specific reporting, indicating, you know, threats of violence 
beyond what we had already produced throughout the election season in the run-up to 
January 6th. 

Q__ Sois it fair to say then, you know, you agreed -- in hindsight, you agree that 
the sort of direction from leadership was appropriate over the summer, and, you 
know -- January 6th, looking back at it, this chart necessarily would not make you rethink 


whether that was appropriate, it would make you rethink whether, you know, the 
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resources that were put into January 6th were appropriate. | don't know if that wasn't 
clear, I'm sorry, but. 

A | think we never changed our opinion that the heightened threat 
environment changed from the summer through January 6th, and, in fact, we produced 
multiple finished intelligence products before and during the election season that 
highlighted that we were in a heightened threat environment, particularly in the run-up 
to the election and the certification of the results. 

So the heightened threat environment, from INA's perspective, did not change. 

It was the focus of the reporting, which in the summer was focused on providing very 
tactical intelligence information to support law enforcement officers, which transitioned, 
through January 6th, to focus on filling strategic intelligence gaps driven by collection 
requirements, focused on true threats and incitement. 

The heightened threat environment did not change. 

Q_ | guess I'm trying to get your opinion, and | think | understand -- respond to 
this criticism -- and I'm sure you've heard it -- that there was -- that it was heavy-handed 
and disproportionate the level of monitoring, collection, and dissemination over the 
summer to the threat landscape, to the picture posed over the summer by the social 
justice protests. If | understand you correctly, you would not agree with that critique? 

A | don't believe it was disproportionate. A DHS law enforcement officer was 
killed within the first week of the civil unrest, and so it was immediate in terms of the 
level of violence that was occurring throughout the country, targeting law enforcement 
officers and DHS personnel. 

So it was very clear from the onset that there was a departmental mission in part 
because one of our officers was shot and killed by a domestic violent extremist. 


Q The number itself, 366, in the span of a little over 2 months, is that high 
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traditionally given other periods that you've had your job? 

A Yes, | think that's high. 

Q Okay. Allright. So we'll drill -- you've mentioned this, but we'll drill down 
on the so-called, quote/unquote, chilling effect or how the interpretation became a little 
fuzzier as you mentioned. 

An analyst tells the OIG, right, that, quote, they thought almost anything was 
reportable during the Portland protests, end quote. Can you explain to me, you know, 
in your opinion, how did that impression, at least with that one analyst, of reporting 
anything, get inculcated, get passed down, get transmitted? 

A | think that was transmitted primarily through the legal guidance, the 
Portland job aid, and then leadership direction to report on threats of violence to law 
enforcement officers. It was very broad guidance to report on threats to law 
enforcement officers. 

And Federal facilities. 

Q_ And just to make clear, right, again, in hindsight, you believe that that 
guidance, that very broad guidance, was appropriate? 

A | think the mission of providing intelligence to support our departmental law 
enforcement officers and their efforts to protect Federal facilities is appropriate. | don't 
believe that -- how broad the guidance was, was appropriate or necessary, based on our 
capabilities and resources at the time. 

We were not built to do that mission. 

Q Right. Sodo you agree -- it's, you know, a little bit said informally, right, 
but do you agree with the characterization -- | don't know if you'll agree -- do you agree 
with the characterization that almost anything was reportable during the Portland 


protests? 
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A No, | don't agree with that characterization. | would say that there was 
broad guidance focused primarily on our mission in the public safety and security space, 
and our departmental mission to enable our components, through intelligence support, 
drove that broader understanding of the heightened threat environment and the 
information that was deemed reportable. 

Q_ Soit's fair, if | understand what you're saying, it's that you understand that 
that impression might've been left on some analysts because of the broad guidance, but 
that that would be hyperbole in your mind than almost anything was reportable during 
the Portland protests? 

A Yes, | would say that's hyperbole. 

Q What role did you play in advising about the guidance dissemination and 
how it should be interpreted over the summer? 

A AsI| mentioned earlier, when the open-source intelligence reports were 
being disseminated, | was very new in the position, and so | had no visibility, coming into 
the role, what the process and procedures were for disseminating open source 
intelligence reports. 

And that level of detail and specificity typically, even to this day, is not right to the 
level of my position. 

Q And|have, like, about 10 more questions, and | think then is it all right if we 
take a break? Ten more minutes of questions, | think, or something? 

A Sure. 

Q Okay. 

A Sure. | was going to say, | don't know if we can do 10 more questions, but 
10 more minutes -- 


Q | meant 10 more minutes, sorry, not 10 questions. 
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A No worries. 

Q One, you know, one analyst in the OIG report called it a pendulum swing in 
terms of at least the interpretation on the guidance dissemination after the summer. 
What about that characterization, do you agree with that? 

A | think it's fair to say that there was a reinterpretation of the guidance that 
reduced the information from which we would report on compared to the summer. 

Q Was it a dramatic reduction? 

A | would say that it was a significant narrowing of scope of mission. 

Q Did that come about gradually, or was it immediate, given | think that you 
said that it was coming from, you know, leadership? 

A | would say that it occurred very quickly after the leadership that was here 
was removed at that time and new leadership came in. It was the first priority to retrain 
the entire workforce on our oversight guidelines, responsibilities, and authorities, and to 
retrain the open-source collectors, which was more narrowly focused on identifying true 
threats and incitement. 

Q Did you agree with the removal of Brian Murphy -- or reassignment of 
Mr. Murphy? 

A | don't agree or disagree on that decision. 

Q But! think | understand you to say that the broad guidance that was being 
transmitted by leadership, including Mr. Murphy, was appropriate in your mind, right? 

A | don't believe that the broad guidance was appropriate based on how we 
were resourced, trained, or experienced to operate in this mission. 

Q | guess as a question of appropriateness, you did believe, as a moral 
question, | suppose, you believe that that way was appropriate? 


A | believe that we have a responsibility to provide intelligence information to 
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law enforcement officers to help mitigate threats that they're facing. | believe that the 
information we sought to provide over the summer focused primarily on identifying 
specific threats of violence to law enforcement officers. And | believe that's an 
appropriate mission for I&A. 

Q Can you talk to me about these sort of -- there's also an interest, right, in the 
privacy of American citizens. That's also, | think, a consideration and a goal that I&A 
seeks to preserve. 

So can you talk about, because it's a spectrum, that tension that, you know, those 
competing interests, and where the happy medium might lie? 

A Yeah. We have an equal responsibility to identifying, anticipating, and 
mitigating -- helping to mitigate threats to the homeland while also protecting the 
privacy, civil rights, and civil liberties of the American people. 

Obviously, that is a very complex and difficult mission when we're operating ina 
space in which we're dealing mostly with U.S. person information, and the extent to 
which the information that an individual may be sharing may be protected by the First 
Amendment or by constitutional rights or be indicative of a threat for which we can 
identify, warrant, and potentially mitigate. 

Q__ So, if you could use, through that scope -- because when | asked you about 
the appropriate level of the broad guidance, you know, you talked about the, you know, 
the benefit of having information, of having information out there and the threat that 
was posed to law enforcement, given that it is a balancing act with what you just talked 
about, talk to me about why, if you so believe that the proper balance was struck over the 
summer of 2020. 

A My understanding of the open-source intelligence reports and other 


reporting that we put out contains specific threats of violence or tactics used to commit 
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violence against law enforcement officers which is not protected by the First Amendment 
or constitutional right. 

Q Okay. Sol want to direct your attention to, you know, the chats between 
the analysts that were referred to by the OIG in its report, and they discuss about how 
the guidance for dissemination is just very high right now. You've sort of talked about it 
as a sort of switch in focus from a more ample, you know, requirement or condition, 
being the heightened threat environment, to potentially a more narrow focus on the first, 
which is the true threats or incitement to violence and not hyperbole. 

Can you talk to me about that perception that it is, that the guidance is high, that 
it's different, that the level of meeting the same guidance dissemination requirements 
that were present over the summer, that they have changed in terms of how strict or 
loose they are? And -- and -- yeah, can you explain to me why that perception was out 
there? 

A Perception that the focus had changed? 

Q | don't -- | don't think that says that the focus has changed. | just think that 
it says -- that the -- | think the chats reveal that they believed the guidance to be higher, 
that the threshold is higher -- excuse me -- let me use the word "threshold." 

A Yes. Yes. So, yeah, my interpretation of those chats is the focus on the 
ability for the collector to identify a true threat, which was not the primary motivator of 
what drove the intelligence collection and dissemination over the summer. 

So the distinction of being able to prove that the individual that is discussing the 
threat -- threatening information has both the intent and the capability to commit that 
act of violence. 

Q_ And, so far in our conversation, | haven't heard you refer to what | think | 


have heard before, including in briefings by the Department, by I&A about this supposed 
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chilling effect, you know, that the criticism leveled at I&A over the summer and sort of 
hesitance, fear of scrutiny or reprisal paired with that criticism. 

Do you personally believe, is that a contributing factor at all in this switch in the 
perception of the threshold? 

A | think it was a contributor, but | would argue that the primary change was 
the guidance that was provided and the lack of clarity and written guidance that helped 
the collectors truly understand their mission in the space. 

Again, we -- outside of the Attorney General guidelines, there's no formal, written 
guidance that helps the collectors apply our guidelines to their daily missions. 

And, with the rescinding of the Portland job aid and the monuments job aid, they 
had to refer back to a 2018 memo for which to glean guidance on their current activities. 

And so they were forced to rely on the information that was provided primarily in 
verbal training and verbal guidance, that was communicated from the Intelligence Law 
Division than more articulate leadership and | would say legal guidance on how they 
should operate in the space, and that was a primary contributor. 

Q You did mention that you believe that the chilling effect was a partly 
contributing factor. Can you describe for us, and it may be anecdotally, how you've 
come to that conclusion? What did you see here that leads you to believe that that was 
a factor? 

A Certainly | think certain leaders at the time were articulating that the 
information we did put out was wrong or inaccurate or that we shouldn't have done it. 
So there were leaders who believed that the reports that we had published over the 
summer were not -- were not okay. And that was, obviously, shared, | think, amongst 
the workforce, that there was certainly a perception that, separate from the three OSIRs 


on the journalists, which everyone collectively agreed should not have occurred, that 
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more broadly the work that the office had done over the summer was not appropriate 
and not seen as positive. 

Q Who were those leaders? 

A At the time, it was, | think, the acting -- | don't know what her position was, 
but certainly Melissa Smislova at the time. She was serving in either the senior official 
performing the duties or the acting principal deputy. 

Q And|know you used leaders, plural, but just her? 

A | don't -- to be frank, | don't recall who was in and outside of the office 
during that time because we had so much leadership turnover. But! think generally the 
sense was that the leadership did not believe that the work that was done over the 
summer was -- was good. 

Q_ And, from your previous answers, | understand, you would not be one of 
those leaders who was fomenting or bolstering that sense? 

A | certainly -- let me turn our camera on, one second. 

Q_ Oh, we see you. 

A Okay, good. We caught it that time. 

| would say that, you know, in the aftermath and looking back on the situation, 
there are always things we could've done better, but | think, based on what was asked of 
us and what we did, you know, | felt that there was a lot of good work that did occur 
throughout the summer. 

And we received a lot of positive feedback from our law enforcement partners 
that the intelligence that we did provide actually helped keep them safe. 

So | think | was probably a little bit more on the positive side in that | do believe 
that parts of what we did actually contributed to improving public safety and security 


throughout the summer. 
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Q Putting aside the mismatch, as you said, between the resources and the 
training and, you know, meeting the moment, meeting the demand of the heightened 
threat environment as you saw it, what were those things -- outside of that, what were 
those things that you said we could do better -- we could have done better? Excuse me. 

A Certainly from my perspective, the leadership guidance direction, the 
training of the officers, preparing them for a dynamic and complex and, in certain 
circumstances, a threatening environment, making sure that they were better equipped 
to do the mission. 

| also think, you know, from my perspective, we published a lot of reports, but 
many of those reports probably didn't have the level of specificity that we could've had to 
better inform the law enforcement officers. So, for me, it's a quality, not a quantity 
metric. 

And so, looking back, how did we make sure that the reports that we did provide 
had, you know, good quality, and that they were informative. So | think that's 
something that we've taken back and applied moving forward. 

And then | would say, again, just the processes and procedures for which we 
handled our work over the summer were either not in place or circumvented or 
misapplied in many cases. 

For example, the leadership dynamics contributed to a lack of understanding of 
our workforce, in terms of who they were answering to and where they were getting 
direction from. 

Q_ And, I'm sorry, the first three words of your answer were "leadership 
guidance direction." What about the leadership guidance direction did you think did not 
work well? 


A | don't think it was effectively communicated and then, again, the resources 
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applied. | think, as you look back, you can see that a lot of this was not documented 
formally from the leadership. There was not that formal guidance provided from 

Mr. Murphy or Mr. Jen to the workforce. Often | think the goal of what we did changed 
and was not effectively communicated. 

Q And my last question before we take our break, | just want to go back to the 
chats between the analysts where they say -- and | want to focus on the word 
"now" -- they say that the threshold itself being just very high now, indicating, of course, 
as you've discussed, that it -- a recognition that it appears to change over time but also a 
recognition that it might be temporary. 

Is that a sense that pervaded in I&A that -- that not only had it changed over the 
summer but that it would continue potentially to change, that it would ebb and flow 
depending on certain factors? 

Ms. Rapoport. Sorry, a. Which page are you on the report? 

BE rn just talking about the chats that are reproduced in the report. 

Ms. Rapoport. Right. Yeah, some of them are redacted. |'m just trying to 
figure out where you're quoting from. 

S| don't need the -- | just need -- I'm talking about the sentiment 
that -- I'm asking if there was a sentiment in I&A that the guidance for dissemination 
would ebb and flow and change over time. 

Ms. Rapoport. If you're referring to any of the in camera documents, | think our 
preference is to keep that line of questioning to the end and go off record for that. 

BS So 'm not - 

Ms. Dobitsch. | think | can answer this -- yeah, | think | can answer your question 
if there was asentiment. | think there was a sentiment that the guidance has changed. 


| think it's also reality; the guidance has changed, you know, to include now, where what 
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was a primary application of the guidance has changed, again, from primarily focused on 
a heightened threat environment to identifying true threats and incitement and then now 
going back to, | think, a more moderate combination of all aspects of our guidelines. 

By a: 

Q But | suppose, on January 6th, there had only been one change, right? So! 
know that since it has changed back, but I'm trying to get a feel from you whether 
that -- whether the sense -- and | know this is, you know, it's a little hard, but whether the 
sense was that it had changed or that it would continue to change, whether it was the 
sort of thing that would change as time progressed or that there had just been one 
change, and that's the change now, it's going to be, you know, permanently. Was there 
a feeling that the -- 

A The -- yes. 

Q  --would continue to change? Go ahead, I'm sorry. 

A Yeah. The perception was that it was right now, yes, because the 
experience was that the guidance has changed with the leadership, and so | think the 
perception was that the current guidance at the time based on, again, the leadership 
focus was much higher. 

ow much time do you need for a break? Do you want 10 
minutes, is that good, or 5? Whatever -- 

Ms. Rapoport. Just the 10. 

Ms. Dobitsch. Yeah, 10's good. 


eo my Perfect. Why don't we come back at 11:16. 


Ms. Dobitsch. Okay. Thank you. 


Thank you. 
I So we're off the record at 11:06. 


[Recess. | 
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[11:17 a.m.] 
WSs So we're back on the record at 11:17. 
BY as : 

Q Let's move on from the summer now toward, you know, the election season. 
There was that memorandum that we talked about put out by ay, this extra -- this 
sort of requiring pre-approval for the dissemination of OSIRs related to civil disturbance 
or the election, among other items. 

What was your understanding of why it was tied to the election, right? The 
summer social justice protests weren't obviously tied to an election in particular. What 
about this election and the anticipated First Amendment activity surrounding, you know, 
claims about its security, what about that in your minds or in the |&A's mind deserved 
sort of an extra layer of pre-approval? 

A In my opinion, | think the political sensitivity associated with the election 
created an added layer of complexity to our mission space, which is already complex. 

So, in addition to making sure that we were prioritizing identifying threats to -- | would 
say threats during the election season and protecting First Amendment-protected 
activity. 

We also had to be conscious that the work that we did in the space could be 
perceived as potentially politically influenced. And so that added layer of review, in my 
opinion, was focused on ensuring that the work that we did was, you know, objective, 
accurate, and appropriate. 

———l Oh, and | meant to ask, | think we're going to go a little bit over if 
that's all right. | was thinking if we could have -- you know, obviously we have that hard 


stop atip.m. Is that all right with you, Ms. Dobitsch? 
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Ms. Dobitsch. Can we -- what time is the next briefing? 

Ms. Rapoport. At 1o'clock. 

Ms. Dobitsch. Yeah. I'd like to eat lunch. So, if it's possible, could we end at 
12:30? 

st starts at 1:300r1? | thought it was maybe 1. 

iia ey | can look. 


——=" Okay. 12:30is good. We'll try to speed along here. 


Ms. Dobitsch. Okay. 
oy 

Q Let me ask you about -- you mentioned the level of sensitivity surrounding 
the election. Is that because of claims coming from, you know, the President of the 
United States and within his administration about the election potentially being stolen, 
this in the lead-up to the actual election? 

A We had observed, among domestic violent extremists, whether in online 
forums or in collaboration with our Federal partners, conspiracy theories associated with 
the outcome of the election, the election itself, and narratives that could mobilize people 
to violence. 

We had seen some instances over the summer that conspiracy theories associated 
with the election, and just the election itself was serving as the potential mobilizer to 
violence. 

And so that was the primary factor entering the election season that drove us to 
assess that there could be violence at events related to the election throughout that 
timeframe. 

Q You mentioned also that this -- | think you said that this memorandum was, 


in part, a response also to the scrutiny that was -- that followed from Portland. The 
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leadership change occurred in August, and this memo came out obviously right at the tail 
end of October, so to be in effect, in essence, in November. 

So there were months in between there where civil disturbance could've sprouted 
and there wouldn't have been this extra layer. Can you explain to me, | guess, why the 
delay -- did the civil disturbance and the perception of scrutiny or the scrutiny at all 
contribute to the release of this memorandum, or was it based purely on the fact that an 
election was coming up? 

A I'm not aware that the dissemination of this memo was related to the 
scrutiny that we had faced. My understanding is that the threats associated with the 
election, again, were very sensitive in nature. It involved looking at -- or differentiating 
between First Amendment-protected activity and threats. 

And so, because of the complexity of the environment and the sensitivity 
associated with ensuring the integrity of our elections, the layers of review were 
perceived as necessary to make sure that we were doing that. 

Q_ The level of review where it should go through you, that you instituted in 
response to the scrutiny over the summer. Is that right? 

A Yes. 

Q  Gotit. Youdid that despite not agreeing with that scrutiny. Is that 
correct? 

A | don't disagree or agree with the scrutiny. | instituted reviewing 
open-source intelligence reports because we disseminated three open-source intelligence 
reports on American journalists, which | did not think was appropriate. 

And it was clear to me, in looking back at those examples, that our processes and 
procedures were not in a sufficient place to appropriately review those reports before 


they were disseminated. 
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Q The memorandum notes that, quote, to ensure timeliness, end quote, those 
reviewing offices -- and it lists there -- would have expanded hours, be on call, and hold 
daily calls. 

Did this extra step of pre-approval delay the process? Taking out judgment as to 
whether it's good or not, did it delay the process of approving OSIRs? 

A [Inaudible] in the run-up to 6 January. | don't think that's what contributed 
to the delay in our reporting. 

Q__ So, if we can, let's talk about the January 5th draft OSIR and about the sort of 
email traffic. | think they're captured in exhibits 3, 4, and 5 in what appears -- but I'd like 
your explanation -- to be confusion between the legal division and the drafters of the 
OSIR, whether, you know, it was rejected. 

What is your understanding, maybe generally, and then I'll ask more specifically, 
as to why that draft OSIR was not approved in time in order to be disseminated before 
January 6th? 

A If you could just give me a moment, I'm pulling up the exhibits now. 

Q Ofcourse. No problem. 

Ms. Rapoport. You're fine. | got it. 

Ms. Dobitsch. Okay. | have them in front of me. Would you mind, please, 
repeating the question? 

a 

Q_ Yes. In essence, | wanted you to give me your top-line understanding of 
why the January 5th OSIR did not get approved for dissemination before January 6th. 

A This is just my opinion. My opinion was that | don't believe that the -- the 
legal guidance was clear and that the collectors did not understand the extent to which 


there was approval to move forward. 
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As | read through these emails, it seems as though the preference from our 
Intelligence Law Division was to communicate via phone, which is very difficult for our 
collectors, who are often operating on different shifts and transferring information 
between shifts and people. 

And so, again, that guidance was never formally documented or communicated 
except for across the collectors. And you'll see in the emails that there's an effort by the 
collectors to try to recap what guidance was being provided by the Intelligence Law 
Division. 

And so there's a lot of back and forth on the capturing, because it seems as 
though there's a preference to communicate that feedback over the phone by -- in 
writing. 

Q Did anyone within OSCO -- | think | said that right -- did anyone reject it, say 
that this did not meet reporting -- or guidance for dissemination? 

A | -- | don't have the specifics on this exact open-source intelligence report. | 
do know that there was quite a bit of back and forth between the collectors to the extent 
that it met the guidelines -- or met the reporting threshold and that the collectors, when 
there was a disagreement on that, that they were encouraged to reach out to ILD and 
their oversight offices to help them navigate that decision. 

Q Are you aware of anyone claiming that leadership kept it from being 
published? 

A Leadership in terms of [&A leadership or the Intelligence Law Division 
leadership or any leadership? 

Q Yeah. | don't know if the members within ILD would be considered 
leadership. | kind of just want to -- if you could define that for me, because there's 


sentiment, | believe, that they should have kept -- the analysts should have pushed more 


24 


25 


56 


to have it published, but that it -- they should've fought more with OSCO and leadership 
to have it published. 

And so | don't know what's meant by leadership. I'm wondering if you have 
heard that same sort of sentiment. 

A So, at the I&A leadership level, which | would consider me and above, the 
deputy under secretary and above, | was not aware of the back and forth until well after 
this product was published. 

Q- Okay. Let's talk about the sorts of intelligence that you were made privy to 
that you had seen. Were you aware, before January 6th, about the information 
regarding the tunnels, that the uptick in visits to the map system of the underground map 
system of the Capitol and a discussion on, you know, TheDonald.Win and other forums, 
regarding the underground tunnels? Had you been made aware of that? 

A No. 

Q_ Sois it your understanding, though, that I&A did disseminate that 
information to partners? 

A I'm not aware that we disseminated that specific information. | know that 
we engaged in engagements that highlighted our concern about the prospects for 
violence more generally as we entered the election certification. But I'm not personally 
aware that that specific information was shared. 

Q_ [think you told me earlier that intelligence you would review if it were 
disseminated, that that is within your, sort of -- | don't know if it's within your job 
description, but that is something that you do. Is that right? 

A For finished intelligence. It's not documented in guidance that | approve 
raw intelligence before it's disseminated. 


Q Yeah. But! do recall asking if you ever -- raw intelligence came across your 
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desk, and you mentioned to me that if -- | believe you mentioned to me that if it were 
disseminated in some way, that, yes, it would. 

A No. My statement was that | rarely, if ever, see raw intelligence reporting 
before it's disseminated. In the exception from December of 2020 through January 6th, 
separate from the OSIRs that went through this process that was dictated in October of 
2020, | personally reviewed OSIRs before they were disseminated. 

Q__ So, in terms of after -- and | think that may have been the distinction that I'm 
forgetting -- you review raw intelligence that's been disseminated, after? 

A | think, let's -- let's change the word. | do not review raw intelligence. | 
read raw intelligence once it's disseminated, more as a receiver, as a customer, than as 
part of a process. 

Q__ So, if there is dissemination from I&A to external partners regarding this 
tunnel information, you may or may not -- well, you said you don't recall -- you may or 
may not have read it after the fact? 

A We never -- we never published. That was not -- my understanding of that 
information was never formally disseminated, and so | never saw it because it was never 
serialized in any sort of formal report. 

Q Right. So formal would not include an email? 

A No. 

Q Were you aware, before January 6th, of the rhetoric involving storming the 
Capitol, occupying the Capitol? Did that make it to your eyes? 

A Other than what | read in a political -- Politico article the day before, you 
know, generally summarizing, | think, what we understood to be broad awareness of 
threats against the Capitol. That was the specificity | had. 


Q Let's go back to the tunnels actually. How about today, as you sit here 


24 


25 


58 


today, are you aware that analysts within I&A were in possession, had received, had 
reviewed, had read indications about the tunnel that | had already explained on the 
record a couple of questions ago? 

A Yes, I'm aware. 

Q Okay. Do you consider that to -- looking at that intelligence, do you 
consider that to have been a constituted -- or contained true threats or incitement to 
violence and not hyperbole? 

A | can only speak retrospectively which is, because individuals stormed the 
Capitol, | would think that it is not hyperbole. Although, to this day, | don't think we can 
clarify whether the individuals that the collectors were looking at actually were the 
perpetrators of the attack. So they could still be hyperbole in many cases. 

Q Do you believe that an OSIR should have been put out about that piece of 
intelligence? 

A Yes, 

Q  Doyou have any -- well -- and is that -- okay. Tell me why. Why do you 
think it should have? 

A Because | believe that while the collector wasn't able to make a 
determination about true threats, going back to those other categories, | see them as 
equally as important in examining the environment for which our collectors are 
operating. 

And we have repeatedly articulated that we were in a heightened threat 
environment in which we believed that violence was likely to occur at election-related 
events. 

And so | believe that, even without making that determination about the true 


threat or incitement, that the heightened threat environment and -- really should have 
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informed our dissemination of that information. 

Q Let's talk about the training that | think you mentioned was instituted soon 
after the leadership change, in the summer of 2020. 

Talk me through how that training went, what was sort of the purpose of the 
training -- in terms of the guidance for dissemination, what was the message from that 
training as to how analysts should be thinking about these requirements? 

A | think very broadly the training was focused on ensuring that the entire 
workforce had a common understanding and interpretation of our oversight guidelines, 
primarily focused on protecting First Amendment activities. 

After or -- either just before or just after the memo was disseminated on October 
30th, there was required training that was specific to our open-source collection, and that 
was geared toward the true threats and incitement. 

Q You mentioned that -- you said that it was made clear that you were still 
under a threatened -- heightened -- excuse me -- threat environment. How was that 
made clear? 

A Our Counterterrorism Mission Center had disseminated multiple finished 
intelligence products highlighting the heightened threat environment in the run-up to the 
election. 

Q And post-election? You said run-up to the election. 

A Run-up to the election, yeah. So! believe we disseminated multiple 
intelligence reports that highlighted that we believed that violence was likely to occur 
during election-related events. 

Q  |see. So not -- you're not saying specifically just for the election, but for all 
events related and you would, | guess, consider January -- 


A The election season. 
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Q Season. Gotit. And you said that there was confusion, though, about 
whether it was a heightened threat environment or not and whether that third sort of 
prong was applicable. Why was there confusion if, as you mentioned, that was made 
clear? 

A There was no confusion from my perspective that there was a heightened 
threat environment. It was -- the confusion was whether or not that was still a 
benchmark to be able to report. 

And the sense was that that was not enough, that the heightened threat 
environment alone was not sufficient to produce intelligence reports that would speak to 
this problem set, that the focus was on the true threats and incitement. 

Q Was that said explicitly? You said the sense was that number 3 was not 
enough. Why wasthat the sense? Was that said by people at the training? Why? 

A _ The training that was provided to our open source collectors, as it relates to 
reporting on the election season, made clear that the focus was on true threats and 
incitement and didn't incorporate context associated with providing intelligence under a 
heightened threat environment. 

Q_ Soit wasn't expressly said that 3 did not apply? It just, by omission, it did 
not mention 3? It basically only mentioned 1, the training? 

A Yes. And think, in certain aspects of the training, there were some -- there 
were some differences that were applied, for example, previously as it relates to an 
individual's ability to have reasonable belief that they're collecting the information to 
support a national, departmental mission. 

Previously we had said that a junior officer, for example, could rely on a more 
experienced officer or manager to help them articulate a reasonable belief, but in this 


process, that had changed, requiring that the individual alone had to produce a 
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reasonable belief. 

So there was a change in how that standard or guideline applied, in addition to the 
true threats and incitement, and in one iteration of the training, it was unclear, as | had 
said, about who can actually determined -- determine what a heightened threat 
environment is. 

And it articulated that things like a finished intelligence product or a National 
Terrorism Advisory System Bulletin was not sufficient alone to make that determination, 
but it didn't make clear what was sufficient to make that determination. 

Q Was that wrong? It sounds as though it is sufficient, in your mind, that you 
put out, that it was a heightened threat environment. 

A Yeah, | believe it was sufficient. 

Q- Right. Were you aware of these deficiencies in the training prior to 
January 6th? 

A No, | was not aware. | did not participate in the training that was specific 
to the collectors in the run-up to the election. 

Q When did you become aware of how that -- the implications from that 
training or how it was perceived? 

A | believe it was after January 6th when | did a review of what was provided 
to my officers throughout and in the run-up to January 6th. 

Q [think you mentioned that you had only seen indications of 
storming-the-Capitol rhetoric, you know, from media reports, and | think you said the day 
before. Would those -- do you believe an OSIR should have been put out for those 
indications? 

A Yes. 


Q_ And is your answer the same as before, you believe the -- which of the three, 
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I'm sorry, of the guidance disseminations do you feel is the easiest for it to fall under? 

A | think it falls primarily under the risks and vulnerabilities associated with a 
heightened threat environment. 

Q And there were also obviously open source indications about Proud Boy 
attendance and other groups associated with violence. Do you believe that those 
might've been captured by an OSIR dealing with the second criteria on here? 

A If there was information online that indicated that a Proud Boys member 
was seeking to commit violence, then absolutely it would fall within that second category. 
I'm not aware of the level of specificity that the collectors had at the time related to 
known threat actors, but absolutely it would have applied. 

Q_ Asyou sit there today, have you seen posts by members of those groups that 
you would consider to be -- to fall under the requirements? 

A | don't review posts, so | do believe that the collectors do report on 
individuals that claim affiliation with groups that have previously committed acts of 


violence. 
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[11:43 a.m.] 
By 

Q Were you aware before January 6th of the December 21st email -- | don't 
know if | have this. Well, yeah, | think it's part of the OIG -- forwarded it to CETC and 
asking them to do additional research into, you know, criminal activity and possible 
violence? 

A Do you have a page number? 

Q It's, unfortunately, inthe OIG report. But let me see. 

Do you know that chart, it's at the back where it has a little bit of a timeline? I'll 
try to find the page for you. 

But | don't know if you're familiar, it refers to as early as, | think, yeah, December 
21st, indications being forwarded to CETC, | believe from members of the Field 
Operations Division. You can see it, | think, on page 50. 

A Okay. I've gotit. Can you please repeat your question? 

Q Yeah. I'm just -- were you aware that as early as December 21st, it was 
forwarded to CETC asking them to, you know, look into references to criminal activity on 
possible violence that may be of interest for State and local parties in the NCR? Were 
you aware of that? 

A No. 

Q Okay. Doyou have any knowledge now about why if -- what CETC did 
about that? 

A No, other than what is in the document that | have reviewed. That's as 
much as | know. 


Q Okay. Doyou have maybe insight into why that didn't lead to any OSIRs 
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or -- right, why it didn't lead to any OSIRs? 

A My understanding at the time was those -- what we call tips or leads 
provided by the Field Operations Division did not meet the individual collectors threshold 
for reporting. 

Q___iODid you think that was an incorrect determination? 

A | can't speak to those specific tips and leads. | didn't see them. 

Q You still haven't -- you still to this day haven't seen them? 

A The tips and leads, no. 

Q Okay. There's an OSCO document in the OIG report that shows members 
tracking January 6th threats from December 29th to January 2nd. Do you know why 
if -- do you know if anything was done about that and, if not, why not? 

A Do you have the page? 44? 

Q Thankyou. | appreciate it. 

A Can you repeat that one more time? If you don't mind just starting with a 
page number, that'd be very helpful. 

Q Yeah. 

A If you have it. If you have it. 

Q  No,Idon't. | know, of course, | would tell you if | did. And | understand 
there's a lot in the report, so | understand it. 

| don't see itin 44. But there's a document that members within OSCO had put 
together tracking the threats that they were seeing on January 6th, between 
December 29th and January 2nd. The OIG at least seems to imply that nothing was 
done with that document. And, obviously, no OSIR was put out about it. 

Do you have any visibility into what happened there? 


A No, | don't. 


24 


25 


65 


Q Okay. So you have no idea why that didn't lead to an OSIR? 

A Again, I'm just looking at the chart. | mean, much of this into this day 
probably doesn't need that threshold. For example, an individual claiming there would 
be not enough law enforcement officers to stop the number of armed people arriving in 
the area. Again, | don't know that that is a sufficient amount of information that would 
be considered reportable. 

Q How did the threats to occupy and overtake State capitols that obviously had 
happened in the -- in the months preceding January 6th -- how were you -- how were you 
viewing that, if at all, in terms of the environment out there, or the kidnapping plot for 
the Governor of Michigan? And do you think your analysts were privy to that sort of 
information out there, that sort of picture of -- threat picture when they were looking at 
these -- this intelligence? 

A The threats that occurred over the summer to the State capitol? 

Q Yes. 

A | think the analysts were certainly privy. The analysts produced multiple 
finished intelligence reports as it relates to, you know, the activity that we had seen 
related to the threat. From the collector's perspective, | think that they had kind of the 
strategic insight, but they did not have the specific investigative reporting associated with 
those activities. 

Q Do you think that -- is it proper for an analyst maybe to see whether -- in 
deciding whether, let's say, in the cases to storm the Capitol are true or not to have 
that -- see it through the lens of what obviously had taken place over the summer, sort of 
dry runs by some of the same groups that were -- posted these things on social media? 
Can that inform or should that inform an analyst's determination? 


A It should inform both the collector and an analyst's determination. 
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Q_ Sois it fair to say you didn't have any input into whether any of the pieces of 
information that we talked about or that made it into the hands of people at I&A, you 
didn't have any input into whether they merited and OSIR or not? 

A No. 

Q_ No intelligence products were produced regarding January 6th before the 
day. Is that right? 

A No raw intelligence products. We had finished intelligence products that 
highlighted the threats during the election season, not specific to January 6th, but 
generally to election-related events. 

Q_ Right. When was the last sort of OSIR dealing with election-related events, 
if you know? 

A _ |don't know. 


Q You don't have a ballpark for me? 


A No. 

Q Do you feel comfortable saying it wasn't in 2021? 

A Atallin 2021? 

Q No. | meant before -- it's all before January 6th, ithasto be. Sol -- was it 


in 2020, the last one before January 6th, do you feel comfortable saying that? 

A | honestly don't -- | don't even know if we produced an OSIR specific to 
election-related threats. Most of the intelligence that we did related to election threats 
was actually in the cyber field from a raw intelligence standpoint. |'m not aware of 
specific OSIRs that were related to elections. 

Q Oh, |1-- because | thought you were making that distinction. Okay. So 
then regarding January 6th, no intelligence fraud -- | thought we were -- no intelligence 


products were produced regarding January 6th before the day, correct? 
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A Yes. 

Q- Okay. I'd like to give you an opportunity to explain here why, in as 
comprehensive terms as you can, citing whatever number of reasons you think 
contributed to why none were produced, approved, and disseminated? 

A Raw intelligence reports. 

Q_ | think you answered that no intelligence reports were produced regarding 
January 6th. So that's my question, why? Why not? 

A So from the finished intelligence perspective, | think our sense was that we 
had warned of the threat to election-related events like January 6th. And as we 
approached the date, we did not have specific or credible information that would have 
warranted an update to that analytic language had already been disseminated, to include 
a week prior to 6 January. 

From the raw intelligence perspective, | don't believe reports were disseminated, 
because the scope and nature of the reporting that |&A was disseminating was refocused 
on specific documented collection requirements and on identifying true threats and 
incitement. And | think collectors were hesitant to collect information that they weren't 
certain met that threshold. 

Q You feel comfortable saying that the election-related event products were 
sufficient, although you can't tell me whether the last one was in August, September, 
October? 

A No. Finished intelligence | can tell you exactly when it was. The last 
finished intelligence product we wrote on threats related to election events was 31 
January -- or 31 December. It was disseminated, and it was explicit that there were 
threats to the election season. 


| cannot tell you what raw intelligence report was disseminated on elections and 
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when the last report was. We produced dozens, if not hundreds of reports, on a weekly 
and monthly basis. 

Q  Gotit. You said that there was no specific credible information or at least 
that -- do you still believe that's the case after having -- | don't know if you have reviewed, 
| guess, all of the intelligence that made it to |[&A and to other agencies and departments. 
| guess, given what you have reviewed, as you sit there today, do you believe that there 
was specific and credible information out there that a, let's say, joint intelligence bulletin 
would have been helpful or would have been appropriate to put out? 

A | think there was sufficient information to assess that this election 
certification was a target of violence. However, in my opinion, | don't believe that a 
product would have been sufficient, because most of the intelligence that we saw 
occurred primarily in the week running up to 6 January. And so, you know, from my 
perspective, law enforcement's ability to prevent what had happened on January 6th 
requires months of planning. And | don't think we had any specific or credible, like | 
said, plot for which we could help them mitigate. And! would say that the information 
we had at the time was something that | understood that Capitol Police and others also 
had access to to inform their mitigation efforts. 

Q So it sounds -- | mean, we're talking about a joint intelligence bulletin. Do 
you think that it would have mattered if an OSIR had been produced -- let's say the 
January 5th OSIR -- if that had actually made it to dissemination. Would that have been 
helpful? 

A My understanding, again, of that specific OSIR was about an individual 
traveling with a gun to a parking lot outside of D.C. | don't believe that information 
would have been sufficient to make a determination about whether or not someone was 


going to storm the Capitol. 
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Q_ So let's talk about the other OSIRs that you think should have been put out, 
ones about the tunnels, ones about storming the Capitol. Would that have mattered, do 
you believe, if an OSIR had been put out on those? 

A | do believe that the references to the Capitol map, to me, you know, from 
my professional opinion, is concerning, and that probably would have been something 
specific enough to disseminate to our partners and Capitol Police. But, again, you know, 
my understanding was that they also had that information. But | believe we should have 
put out an OSIR on the tactics and techniques that were potentially being considered to 
storm the Capitol. 

Q You don't think there's some value in having a joint intelligence bulletin 
being put out by some of the major Federal agencies who are tasked with this work, FBI, 
and DHS, I&A, that -- you know, you mentioned, you know, Capitol Police had this 
information. You don't think that putting out that warning would have sent a message 
and would have conveyed a sense of urgency that might have been helpful in protecting 
the Capitol that day? 

A | absolutely believe it would have been valuable and would have contributed 
to a sense of urgency. | don't know that it would have actually made a difference in 
terms of the operational planning, in part because, again, we did not have a level of 
specificity to warn us in terms of specific access point, a time and target of the attack, a 
tactic being used. It was a general -- general threat environment. 

And | think for us the miscalculation was that we believed that there was a 
common understanding across the U.S. Government, across our State and local partners, 
and what was being reported in the news that violence was going to occur on 6 January. 
And so, clearly, that -- that general belief that many people thought violence was going to 


occur did not spur action. 
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Q What was your understanding as to whether -- you know, there was also a 
belief by some that the same level of violence, skirmishes between protesters and 
counterprotesters from MAGA | and MAGA II, November 14th and December 12th, that 
January 6th would just be a repetition of that, that that's the sort of level of violence. 
When you say violence on January 6th, that that's what the expectation was and not that 
January 6th would be different in scope and severity, and that Congress itself would be 
the target, which is what an intelligence bulletin put out by U.S. Capitol Police, released 
internally, put out, did say that the focus would not be protesters and counterprotesters, 
that the focus would be Congress itself. 

What was your understanding going into January 6th as to -- you said that, you 
know, everyone kind of understood there'd be a level of violence. What did you think 
about that level of violence in comparison to MAGA | and MAGA II? 

A I'm not personally tracking what the level of violence was on what you're 
referring to as MAGA! and MAGA II. _ | know that in the run-up to the certification of the 
elections, | asked my team to pull information we had to understand to what extent the 
violence was likely to occur. We evaluated that decision, which was noted in the chart 
on the indicators as it relates to the events, and that many of the indicators had been 
observed. | think a key distinction was the week of, the Mayor of D.C. asked for a light 
law enforcement footprint and asked for counterprotesters not to attend the day's 
events. Those are two pretty significant indicators that were swaying in the opposite 
direction in the run-up to the election. 

Our standing analytic line was that often the violence occurs against protesters 
and counterprotesters and against law enforcement. So if the Mayor was announcing a 
light law enforcement footprint and encouraging counterprotesters not to attend, those 


are two major triggers that we would rely on to make determinations about the nature of 
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the violence. 

Q Well, so that first part, were you aware that she had requested support from 
the National Guard? 

A lam not aware. 

Q Okay. |mean-- 

A | was not aware at the time. | think now obviously that has come out, but | 
was not aware at the time. My understanding was, again, that there was a request for a 
light law enforcement footprint that day. 

Q Yeah. And | believe also that the chief of police put out and all hands on 
deck for every member of the Metropolitan Police Department to work that day. 

A I'm not -- that, to my knowledge is not public. I'm only speaking to what 
the Mayor had announced publicly. 

Q Yeah. And | guess, what is your posi- -- or belief or thoughts about the fact 
that, you know, different departments did posture differently, right? The Metropolitan 
Police Department postured in a way where, as we looking back can see, they were able 
to respond quickly to assist Capitol Police with the breach. Whereas, Capitol Police 
postured differently, as we can see, than that, obviously, not, so successfully. 

Do you think it's right that everybody sort of understood the same level of urgency 
and gravity when it came to the potential for violence on January 6th? 

A | don't think | understand your question. You're asking me if it's right that 
everyone understood the same level of urgency? 

Q No. Ifit'scorrect. Right? Right isn't morally right. Isit accurate? | 
believe you did mention that earlier that you thought that -- | guess I'm wondering if you 
still think that, if you still think that everyone did share the same understanding of the 


threat picture heading into January 6th? 
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A No, | think that's what we determined was not the case. In the run-up to it, 
our perception was that we thought that our partners generally understood the extent to 
which violence would occur on that day. After the fact, our interpretation is that our 
strategic warning didn't resonate and that the shared sense of urgency and the prospect 
of violence were not shared. 

Q Sol want to talk to you about exhibit No. 7. And while you're flipping to it, 
| will, just for the record, it's a letter from an intelligence operations specialist. | want to 
use the right -- well, let me ask you. Who was the author of this letter? 

A My understanding -- this is the first time I've seen this letter as part of this 
interview. And my understanding is that this is a very junior officer in the 
Counterterrorism Mission Center. 

Q What's his or her name? 

A | don't believe it's appropriate to share their name. 

Q  Noworries. |'m going to call -- I'm going to say she. | was going to ask if | 
can have a gender, but it's fine. | don't think for the record it matters. 

So it's a letter from an intelligence operation specialist talking about how she 
came across what she called 500 pages worth of credible indications of violence for 
January 6th as early as December 20th on her own personal time without searching for it, 
approached the senior member at CTMC with the information, and was told it would be 
related to OSCO. She goes on to say she submitted the names of several platforms, 
including thedonald.win and Parlor, as being full of these indications. Following up daily 
as time went on, brought up the time sensitivity if there was any hope that a joint 
intelligence bulletin might be produced or at least memorialized in an OSIR. And 
ultimately says she gave a briefing that was conveyed internally to leadership about the 


potential threat, but that nothing was pushed out. 
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Are the factual claims, as far as you know them, in the letter accurate? 

A | have no idea. My understanding of this was never even raised to the 
leadership of the Counterterrorism Mission Center. So |'m not -- | have no idea whether 
or not this is accurate. 

Q_ The letter appears to be dated from August. You had not received -- you're 
over her. | know she's a junior officer, but being a member of -- she's a part of your 
team, under your direction, correct? 

A This individual would probably be four or five layers below my position. 

Q_ Right. But still under your umbrella, correct? 


Yeah. 


> 


Q Do you have any -- why was this letter not shared with you? 

A | don't even know who it was addressed to. | don't know where it went. 

Q Well, it was provided by your department, so it obviously went to I&A at 
some point. 

A Ordidn't. It could have gone to OIG. I've never seen the report, so | don't 
know where it went. 

Q Yeah. But this document was not provided to us by the OIG, it was 
provided by you guys. 

But, okay, no worries. If she doesn't know, she doesn't know. That's nota 
problem. 

How about, are you aware of the briefing that she talks about that she says was 
given to senior leadership? And | do think that that is also referred to in the OIG as 
having happened. Are you familiar with that? 

A Do you know where in the letter does it say that? | do think | know what 


it's talking about. | just want to reread it again. 
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Sure, no problem. | -- you know, it's obviously three pages, and it's not -- | 


don't know if | can give you an easy reference. But I'Il try to find it along with you, if | 


can, as fastas|I can. It should be by the bottom. It's one of the last things she says she 


does. | think maybe even -- 


A 


Q 
Q 
A 


Q 


Yeah. 


| think | found it. 

Okay, perfect. Yeah, first, full paragraph on page 4. 

Yeah. Foundit. Okay. Can you please repeat your question? 
I'msorry. You're reading it, you said? 

Yeah, | have it. Could you please repeat your question? 

Oh, okay. | missed your question. 


Are you aware about that briefing that was given to leadership? And let 


me know if you know whether it transpired or not or whether you were a part of it. Like 


| said, | believe the OIG indicates in the report -- it mentions a briefing to leadership about 


the threat sort of landscape. 


A 


Q 


> Pp 


Q 


Yeah. I'm aware. 

Were you a part of it? 

Yes. 

Okay. Was this junior -- or who gave the briefing? 

Intelligence analysts from the Counterterrorism Mission Center. 

Okay. Did this junior officer participate or was present at all? 

| don't know. | don't know who the identity is of this. This is redacted. 


Okay. Oh, | thought when | asked for her name, you said you didn't feel 


comfortable giving it. Is your answer that you actually don't know the name? 


A 


| know the name of the individual who gave me the briefing. | do not know 


if that individual is the person in this letter. 
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Q_ Right. So when! asked you about the identity of the letter, your answer 
was | don't feel comfortable giving it. You didn't say, | actually don't know who it is. 

A | think | know who it is, but | currently have only ever received a letter that is 
redacted. It doesn't have the person's name. 

Q Okay. So-- 

A | do not know for certain who this person is. And my understanding is that 
the individual is very junior, and | don't feel that it's appropriate to share that name based 
on the junior nature of the person. 

Q But | just want to make clear because we're on the record. Do you know 
the identity of the person or do you not know the identity of the person? 

A | do not know the identity of the person in this letter. 

Q Okay. So you also then do not know whether they're a junior analyst? 

A My understanding is -- what | understand is that this person is junior. Like | 
said, | -- | am surmising, | am analyzing this letter based on what they say in this letter that 
this person is a junior officer. 

Q Okay. Gotit. Right. Sol just want to use the same -- the same way you 
do not know the identity, you do not know, the way you're using it, that whether it's a 
junior analyst. You are speculating or surmising as to both. — Is that fair? 

A Yes, |am speculating who the author of this letter is. 

Q Perfect. | just want to be consistent across questions. 

So can you tell me what was conveyed to you, what was the top line message 
conveyed to you at this briefing? 

A The briefing was | asked my team to pull a product that we had done 
analyzing the indicators of violence in Portland and apply those indicators to the events 


that were taking place on 6 January. And so the intelligence officer provided their 
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assessment on the extent to which those indicators had observed in the run-up to 6 
January. 

Q And what was the substance of what was provided to you? 

A It's noted in the OIG report in the charts that most of the indicators that we 
had identified for Portland had been observed. 

Q_ The chart, as we had talked earlier, has a number that had not been 
identified as Portland. Is that chart accurate, in essence? 

A | have to pull up the chart. 

Q  Noworries. 

A But | believe it's probably generally -- generally accurate. 

Q Okay. You don't disagree with their characterizations of whether those 
categories are met or unmet as it pertains to the summer? 

A No. 

Q  Sowhen it was presented to you, was it presented to you as more of the 
indicators are met leading into January 6th than they had over the summer? 

A Yes. 

Q What, if anything, did you and leadership do about that, having received 
that -- 


A We briefed it. We briefed it to our leadership, to DHS leadership. 


p 


The Secretary? 

A The deputy secretary. 

Q Okay. Who was that at the time? 

A Mr. Ken Cuccinelli. 

Q  Gotit. Did you ever consider putting out anything, a product of any sort, to 


your partners conveying what you had been told at that briefing? 
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A We considered it, though, this was the day prior and we don't have the 
ability to turn a product around usually within a day in order to get the appropriate 
clearances and coordination that's typically required of a finished intelligence product. 

Q__Isthat what stopped you? You said you considered it. So does that mean 
that you believed it to be possible, or was that the only impediment to putting forward 
something? 

A We considered taking the exact same product we did for Portland and 
producing it for 6 January, but we were not capable of being able to turn around the 
product in a timely manner for which it could have provided warning before the morning 
of January 6th. 

Q Was that the only motivation or -- was that the only thing stopping you is my 
question? Was there anything else that led to -- I'm sorry? 

A _ That and the lack of actual documented reporting. My understanding was 
we didn't receive any raw intelligence collection except for an IAR from FBI the morning 
of. 

Q Okay. So the lack of OSIRs that your own I&A or other agencies had put out 
factored into not putting something out that day? 

A It was both the lack of raw intelligence reporting articulating a specific threat 
to 6 January, our access to those reports, and our inability to be able to turn around a 
product with that period of time with the requirements that are in place for producing 
finishing intelligence. 

Q__ If those OSIRs that you believed would have appropriately met the guidance, 
the dissemination guidance, if those had been produced, do you think that putting out 
something -- that you guys would have put out something, or would the late hour still 


have stopped you from doing so? 


24 


25 


78 


A | think it depends on, you know, if we look -- if | look back at the time -- if we 
had produced OSIRs related to, | think, the maps that we had seen related to the Capitol 
Buildings, and the more of that specificity to me that indicated that there could actually 
be a plan in place to storm the Capitol, and we had done that at least a few days in 
advance, we would have put a product out. 

Q  Mrylast question before | turn it over to my colleague. | know we still have 
18 minutes. If we can talk about exhibit No.1. It's an email from you asking about the 
FBI's threat picture on January 3rd, 2021. That's the day of the email. I'm wondering, 
what caused you to ask that question? 

A Again, | think, yeah, as we entered the day of January 6th, our sense was 
that violence was likely to occur on the 6th of January, but we didn't know what type of 
violence or how substantial the violence would be. We were -- it was what we call a 
hunch, obviously, understanding that the threat environment at the time and the amount 
of mis, dis, and malinformation online associated with the outcome of the election, that 
the environment and the conditions were ripe for violence. However, we did not have 
reporting indicating that there was a specific threat to the Capitol at that time. Andso 
most of our efforts were focused on acquiring that information, whether it be from our 
FBI partners or our State and local partners. 

Q  Am|reading the response correctly that the FBI had not settled on sort ofa 
threat level written or unwritten for the week? And, in fact, it sounds like the person 
corresponding with you conveyed -- that they had conveyed a less of a concern with the 
groups showing up to protest and more of a concern for violence between protesters and 
counterprotesters. Is that how you read it as well? 

A Yes. 


Q Were you surprised that you had not received a comprehensive threat 
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assessment for January 6th from the FBI? 

A | wasn't -- | don't think we would have expected a comprehensive threat 
assessment. | was more surprised that we didn't receive things like the SIR that was 
published and the IAR that was published earlier. It seems as though they did have 
some information available to them that they did not disseminate to us. 

Q Andwe talked a little bit earlier about you weren't quite sure about the 
levels of violence or the types of violence at the first two rallies. But so this concern 
about less with the groups and more for violence between protesters and 
counterprotesters, is that how you also envisioned leading into January 6th was the main 
concern for violence? 

A __ Yes, that was what we had seen throughout the summer and at most large 
protests was that most of the violence, as | had mentioned earlier, related to the Mayor's 
public statements was that we saw most of the violence occur against law enforcement 
or against protesters and counterprotesters. 

Q Okay. And you still -- did you guys still maintain that belief that law 
enforcement were potential targets for the protesters -- the demonstrators protesting 
the election certification? 

A I'm sorry, can you repeat that one more time? 


Q Law enforcement, were they still targets? You mentioned that over the 


summer -- 
A Yeah. 
Q- -- you saw not only violence with counterprotesters but violence directed 


towards law enforcement. Was that your understanding of the threat picture dealing 
with these demonstrators? 


A Yes, and that | believe that was what was also disseminated in our 31 
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December intelligence report on the topic. 

Q_ Anti-law enforcement sentiment? 

A Yes. 

Q Okay. Mycolleague now has some questions for you. 

By 

Q_ Thanks for your patience. | have a number of questions. |'m not 
sure -- |'m fairly certain I'm not going to get to all my questions, so I'll try to hit several 
that relate to the stuff that we've already talked about, Deputy Under Secretary, if it's 
okay. 

Thanks, aa. 

So going back to your role as a consumer or a reviewer -- and | apologize to go 
back to this. | know we've done this repeatedly, but | just want to make sure that | ask 
you a question about this. As aconsumer or reviewer of raw intel while you were 
deputy under secretary, could you list the number of times a piece of I&A raw intel that 
you read, either as a consumer or reviewer, gave you pause; in other words, it 
wasn't -- you didn't think it was particularly useful, it may have been improperly collected, 
or that there were other tradecraft concerns with that piece of raw intel? 

A So in terms of my viewing the raw intelligence, generally, | would never have 
pause as it relates to whether or not we should -- we can collect on it. Most of my 
pause is about -- was about whether or not we should have collected it, and then focused 
on, again, the quality and the specificity of the reporting. 

In my job, | strive to produce intelligence, whether it's raw and finished, that is of 
high quality and helps to fill intelligence gaps. In looking at some of our raw intelligence, 
it was unclear to what extent the information provided that level of specificity from time 


to time. 
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Q Roughly, can you give me a sense of how many times this happened? 

A | would say it was more the exception than the rule. 

Q Okay. When it comes to raw social media collection, the raw intelligence 
collection, speaking in your role as deputy under secretary for the enterprise or its 
operation, do you think in -- generally, raw intelligence is collected with very little analysis 
applied to it, correct? With social media -- and you are nodding in agreement yes? 

A Yes. 

Q_ Thank you. 

Do you think that social media collection should require some sort of basic 
analysis of the source; in other words, the number of followers, the person the subject 
has, the number of likes that poster sees, the times it's been shared, whether it's clearly a 
joke, whether it has a political motive? 

A Absolutely. 

Q Do you think I&A does that effectively? 

A _ Yes, | believe that's what we call the reasonable belief standard in that our 
collectors need to identify the advances in the national departmental mission. And that, 
as you discussed throughout this interview, that as it relates to threats of violence, meets 
at least one of the criteria associated with a known threat actor by a threat environment 
or a true threat. 

Q_ And does -- you don't think that -- like, so if someone has three followers 
and, you know, there's a sense of the product -- or the item reaching threshold, you don't 
think -- that's something that passes -- that's passable, that's -- that goes out, that's okay? 

A It depends on the content. _ If it's an individual that we know is in the 
proximity of a target for which they say they're going to threaten or kill and imply that 


they have sufficient capability to do so, it doesn't matter how many followers they have. 
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Q When it comes to field intelligence reports, FIRs, right, does I&A take into 
consideration that the sources of those FIRs are often law enforcement, State and local 
law enforcement officers potentially, or they come from fusion centers where certainly 
there's a heavy presence of State and local law enforcement? 

A Yes, that's primarily the collection we do from a HUMINT capacity. 

Q  Doyou suspect that such collection might be hypersensitive to police-related 
issues? 

A | think that with any intelligence, a source can be providing information to 
influence and inform that's across the intelligence spectrum. 

Q_ Is there any chance that there might be some sort of anchoring bias in such 
kind of reporting, especially if you're dealing with reporting relate -- you know, coming 
from police agencies about violence -- potential violence related to protests, policing, et 
cetera? 

A | think all of us have anchoring bias, and | think many sources have anchoring 
bias, whether they work in law enforcement or a private sector, and approach how they 
evaluate and share information based on that bias. | think that that's why it's 
considered raw. And it's up to our analysts to determine the credibility and veracity of 
that information provided by that source. 

Q Going much broader, could you remind me again of your career before I&A? 
You said you'd worked in the IC. Could you tell me which agencies, please? 

A | spent time in the Defense Intelligence Agency, | supported some efforts in 
the Central Intelligence Agency, and | worked at the Office of the Director of National 
Intelligence. 

Q- Thank you. 


Were you ever a special adviser to Vice President Pence? 


24 


25 


83 


A Yes. 
Q And what did you do in that capacity, please? 
| served as his special adviser for Middle East and North Africa issues. 

Q_ Thank you. 

Going broader about I&A, could you tell us about how I&A changed under the 
Trump administration? How did its structure change, for example? 

A | was not at DHS for most of the administration. | came into DHS in the 
summer of 2019, and at that time, there was no organizational change that | was aware 
of. |'m aware that sometime several years earlier, that the organization has been 
realigned into mission centers, but | don't have a lot of detail on the -- how that occurred. 

Q_ Thank you. 

What was I&A's morale like under the Trump administration? 

A | can only speak to the morale during the time for which | spent at I&A, 
which, again, starts back in the summer of 2019. And 1 would say when | came into I&A, 
the morale was very low. 

Q Why? 

A | believe that the morale was heavily influenced by the nature and style of 
the leadership at the top of the organization. 

Q_ The top of I&A or DHS or both? 

A I&A. 

Q Could you talk to us about the leadership? Could you give us your 
judgment of Dave Glawe as a leader and Brian Murphy, his deputy, as a leader? 

A From my perspective only, | would say that Mr. Glawe at the time spent 
most of his time out of the office, and so did not have a lot of connectivity with the 


officers at our headquarters element. And Mr. Murphy was delegated most of the 
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responsibility to run the office day to day. Mr. Murphy had a very direct leadership style 
and communications style, which often was perceived as toxic or hostile to many 
employees. 

Q __Isit fair to characterize them as ineffective leaders? 

A | would say that they were effective in some ways and ineffective in others. 

Q Could you elaborate? 

A | would say, from my perspective, that both leaders had a fairly good vision 
for the organization in terms of where we should be headed and what we should be 
prioritized on in many instances. | think where the deficiencies occurred were in the 
execution and implementation of the priorities and goals. 

Q How well versed were they in intelligence work? 

A | believe both leaders spent time in the intelligence community. | believe 
Mr. Murphy came from the FBI, and Mr. Glawe had also come from the FBI and had 
served for a time in the Office of the Director of National Intelligence. 

Q_ Soasan intelligence professional, you're, I'm sure, keenly aware of IC 
Directive 203? 

A Yes. 

Q Yeah. It establishes standards that promote a common ethic for achieving 
analytic rigor and excellence. The top two of the five analytic standards it lays out 
require analysts to be objective and independent of political consideration. 

While you were at I&A under the Trump administration, can you -- do you think 
that I&A lived up to these standards? 

A Yes. 

Q How hard was it to do so? 


A It was difficult. 
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Q Could you please explain why? 

A | think at the time the leadership that was in place applied pressure to the 
organization and to the processes that oftentimes could have compromised our 
objectivity, and supported other efforts to inject perspectives in the process that could 
cause us to violate the IC standards and directives which we operate under. 

Q Could you please describe such instances? Do you have specifics? 

A In the summer of 2020, we were analyzing the threat associated with the 
violence that was occurring in Portland. We didn't believe we had a level of specificity in 
reporting to understand who the perpetrators were of that violence. And so we hada 
lot of discussions about what -- how to characterize those actors. At one point, we had 
agreed upon the definition that we refer to as violent opportunists, so individuals that we 
know were seeking to commit violence, but it wasn't clear what their ideological 
motivation was or if they had an ideological motivation. 

However, as the summer progressed, there was a sense among the workforce that 
leadership increasingly wanted us to refer the violence or attribute the violence to 
individuals who adhere to what we consider to be the antifa ideology. And at one point 
in the summer of the -- the Senior Officer Performing the Duties of the Under Secretary 
issued guidance to our collectors to actually attribute the violence in Portland to antifa. 

Q  Whywasthattroubling? Just, | think | understand why it's troubling, but 
could you very clearly tell me why that would be troubling to an intelligence professional 
such as you? 

A | believe that our collectors and our analysts should accurately describe the 
information, particularly as it relates to raw intelligence as they see it and based on the 
information they have available to them that is objective. And it's on those officers to 


make those determinations, not the leaders. 
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Q Thank you. 

Do you have any comments regarding the release of the Homeland Threat 
Assessment, its delayed release, and I&A's diminished role, | believe, in the production of 
the assessment? 

A Do you have a specific question? 

Q Yeah. Do you think that that was in the instances at which I&A leadership 
or department leadership tried to guide intelligence analysis or shift it away from certain 
perspectives? 

A In my opinion, | think there was a difference of opinion between I&A leaders, 
DHS leaders, and the workforce on the extent to which some of the incidents that 
occurred over the summer were considered to be terrorist acts. Andso there wasa 
difference of opinion, and that drove some of the decisionmaking in terms of how the 
Homeland Threat Assessment was ultimately produced. 

Q_ | know we're running on -- at the end of our time -- running up to the end of 
our time, but | just wanted to ask how. How did it affect the release, the production, 
the development of the Homeland Threat Assessment? 

A It delayed the dissemination of the Homeland Threat Assessment, and it 
changed the scope of the Homeland Threat Assessment, which initially started as 
primarily an intelligence document and then later transitioned to a document that was 
informed by intelligence, which included input from nonintelligence offices from across 
the Department. 

Q From your position at the time, why, why did that happen? What were the 
motives behind those changes? 

A | think there were probably a variety of reasons. One was that there are 


certain aspects of the Department's mission which I&A doesn't cover, for example, 
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human trafficking, natural disasters, things that don't necessarily have a strong 
intelligence nexus but they might have a law enforcement or departmental nexus. So 
there is an interest in including more details on those aspects of the Department's 
mission. 

| also think that there was a difference in how we characterize the nature of the 
events that took place over the summer and that the intelligence perspective was not as 
inclusive as the Department wanted as it related to things that we would believe would 
fall outside the purview of our mission. 

Q Could you drill down on that last point, please? 

A | think it was -- what it boiled down to was the definition of terrorism. The 
definition of terrorism is very broad, and you can make an argument that anyone that 
engages in violence with the intent to change a political outcome is a terrorist. Andso| 
think that we scope our interpretation of what we mean by terrorist a little bit differently. 
And we would argue that there is probably, from our perspective and from the guidance 
that we got from our lawyers, there used to be a level of, let's say, destruction and a level 
of violence that raises to the level of a national security concern. And that is different 
from, | think, the perspective of a law enforcement agency who is just focused on the very 
tactical nature of the violence that's being perpetrated against them. 

Q Was it a difference that was shared by your leadership? 

A The difference in that they agreed with, | think, my perspective versus the 
Department's perspective? 

Q Which perspective did they agree with and why? 

A Well, we went through, | think, at least two leaders during this timeframe. 
So actually approached the dissemination of the Homeland Threat Assessment -- | believe 


Mr. Maher was in the seat at the time. And sol think certainly he was of the mindset 
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that he was sticking with the intelligence assessment, but he recognized that the 
Department wanted more input from the law enforcement side. 

So there was a recognition, | think, by HEEEMithat he wanted to stay where we 
were at the intelligence. But we were open to incorporating input from nonintelligence 
components, so long as the threat assessment was not considered an intelligence 
document. 

Q__ This is going to be, thankfully, my last question, and I'll let you go for lunch. 
Does that qualify as politicization of intelligence? 

A | think politicization, from my perspective, is when the actual intelligence is 
changed as a result of a political consideration, and | don't believe our intelligence was 


changed as a result of that. Sol would not consider that politicization. 


Saeen Do you have anything else? 
es. 


Ms. Dobitsch, one question, and then we promise you're off to lunch. And if we 
have to start a little bit after 1 o'clock, that's fine on our end. 

| want to clarify one of the answers that you gave when you said that you never 
saw raw intelligence related to January 6th. And just so | understand it, and that's 
because there wasn't an OSIR that was a final written product or a final product, period, 
that got to your level. Is that right? 

Ms. Dobitsch. To clarify, | don't know that | said never, but if | did, I'd like to 
clarify that | rarely ever review raw intelligence before it is disseminated, across the 
board, regardless of the direct topic, to include any reporting in the run-up to 6 January. 
That falls with a couple layers below me in terms of review and dissemination. 

| receive raw intelligence reporting more so as a customer who's reading it after 


it's already been disseminated. So regardless of whether or not we would -- had 
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produced an OSIR related to 6 January, | likely would not have reviewed that before it was 
disseminated. 

[Reporter asked for clarification.] 

Ms. Dobitsch. Open source intelligence report. 

os. 

Ms. Dobitsch. Yes. Sorry. Acronym, OSIR, open source intelligence report. 

And just to -- again, just clarify again -- clarify again, in the summer of 2020, circa 
August timeframe through January 6th, | personally reviewed every OSIR that was 
disseminated, except for those OSIRs that went through a process that was dictated in 
the 30 October 2020 direction from a. 

Ys 

Q Right. |appreciate that. And because there was no OSIR related to 
January 6th, it's logical that you didn't review any OSIR related to January 6th, right? My 
question is -- 

A Yes. Yes, | did not review any OSIRs related to January 6th. 

Q = So unpacking that, what, if any, raw intelligence did you review that was 
related to January 6th? Understanding there was no OSIR, is it fair to say then that you 
didn't review any raw intelligence related to it? 

A | -- to the best of my knowledge, | did not review any raw intelligence related 
to January 6th -- 

Q Okay. So-- 

A -- prior to January 6th. 

Q Okay. Somynext questionis: I&A had issued this report on 
December 30th about the use of -- about reports on domestic violence extremism 


landscape, right? So that was a product that came out from I&A. And then there was 
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nothing drafted productwise until, obviously, after January 6th. 

Did you as an intelligence officer think -- you know, even though you're not seeing 
it as not being pushed up to you from four levels down, did you have a moment where 
just as a person knowing the significance of the joint session on January 6th, that 
something was going to happen? 

A Absolutely. And | think the documents show that | was actively pursuing 
any information | could to help flesh out what | thought that threat might be. 

Q  Sothen my question is: When you say that there was a common 
understanding within I&A and your Federal partners that there was a potential for 
violence, where is the responsibility of I&A to push that message out? 

A | think it is a responsibility. | think we believed that we had done that with 
the 30 December report, and that the press reporting was so specific. | think even in the 
political article, it talked about the storming of the Capitol. Our job is to provide 
intelligence value and to go beyond reporting in the press. We did not have any 
reporting that went beyond what the press was providing already. 

Q But! think you agree that the December 30th, the value of it was not specific 
to January 6th in any way. You said that earlier. It didn't mention January 6th at all. 

A | think there was incredible value in that we highlighted that election-related 
events and targets -- or election-related events were targets for violence. We did not 
specify 6 January as one of those events. 

Q But help me reconcile the common understanding that January 6th was a 
problem and the lack of a warning by your organization about this, quote/unquote, 
common understanding. 

A The lack of a warning in part was because most of the activity that we had 


seen was occurring just days to hours before. We participated in calls with National 
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Fusion Center Association, who communicated that they had access to this information. 
We were told that our D.C. fusion center had access to this information which was being 
distributed amongst the Capitol Police and the press. And so, again, that we believe, at 
that time, that the warning was people were aware of the same concern that we had. 
And that was articulated by our partners in multiple engagements in the run-up to 6 
January. 

Q But, Ms. Dobitsch, does the organization -- does I&A have the same 
responsibility as the press? Isn't there more credibility when it comes from a 
government agency versus what's being reported in press articles? 

A Yes. Absolutely. A part of our job is to help provide context with what 
we're seeing in the media. 

Q  Sowhen you say we weren't seeing anything that wasn't reported in the 
press, wouldn't there have still been value to put out something specific to January 6th 
from an intelligence agency? 

A Yeah, of course. Looking back on it, | think we agree that we wish we were 
in a position to have put out a product warning of the potential threats associated with 
January 6th. 

Q Okay. And just as we ask all our witnesses, you know, kind of the lessons 
learned from January 6th, and obviously you just mentioned one now, is there anything 
else, you know, whether it's structurally that kind of my colleague hit on, or in terms of 
the thresholds, or what do you think could be done better for the institution? 

A Certainly, we concurred with the recommendations in the OIG report on 6 
January. We've made quite a few changes in terms of the structure, the leadership, the 
supervision, the processes and procedures, the direction, the guidance. Just about 


everything we've done as it relates to our open source mission, we've strengthened from 
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top to bottom. 

And so | think the lesson learned from I&A's perspective is that we need to make 
sure that our intelligence resonates with the partners that are responsible for mitigating 
the threat, and that we strive to provide accurate and timely and responsive information 
to warn of threats. 

Q Okay. Thank you for that. 

«t's that time. 
f= Yes. Well, it's 12:40. Do you want to start later -- | think it's 


just us coming to this briefing? 


Bt will also be - 
ee Oh, okay. Do you want to start at 1:15? Is that -- 1:15 is 


okay on your side for your briefers? 
SS And what do you need for lunch and to take a break? It's been 


a long morning. 


2b. 
Ss So yeah. 
Ms. Dobitsch. Okay. 1:15 works. Thank you. 
1:15 works? 
Ms. Dobitsch. 1:15 works. Yeah. 
Okay. Thank you, Ms. Dobitsch. And we're off the record. 
Appreciate your time. 
HE And for the record, the transcribed interview stands in recess, 
subject to the call of the chair. Thank you so much. 
[Whereupon, at 12:43 p.m., the interview was recessed, subject to the call of the 


chair.] 
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